Security readout for executives and security teams
Plain-English summary
Mattermost Server versions before 3.0.0 had an XSS issue tied to the Legal or Support setting. The public record is sparse, so business urgency depends on whether any legacy Mattermost instances remain. There is no provided evidence of active exploitation.
Executive priority
Prioritize if legacy Mattermost remains in use, especially internet-facing or broadly used internal instances. If all Mattermost systems are modern and supported, this is mainly an inventory-confirmation item.
Technical view
CVE-2016-11073 is described as XSS in Mattermost Server before 3.0.0 via a Legal or Support setting. The source bundle does not provide CVSS, CWE, attack prerequisites, impacted UI path, or exploit status. Treat this as a legacy web application input/output handling issue requiring version and configuration validation.
Likely exposure
Exposure appears limited to Mattermost Server deployments older than 3.0.0. The source bundle’s affected-product metadata is incomplete, so confirm using internal asset inventory and vendor release guidance.
Exploitation context
The provided sources do not show active exploitation, public weaponization, or KEV listing. The record only states that XSS is possible through a Legal or Support setting.
Researcher notes
The public data is thin: no CVSS vector, CWE, exploitability details, or exact fixed release note is included beyond “before 3.0.0.” Avoid assuming authentication requirements or affected rendering contexts without vendor confirmation.
Mitigation direction
- Identify any Mattermost Server deployments older than 3.0.0.
- Upgrade legacy Mattermost instances according to current vendor guidance.
- Review Legal and Support setting values for unexpected script-like content.
- Restrict administrative access to configuration settings.
- Check Mattermost security updates for version-specific guidance.
Validation and detection
- Confirm deployed Mattermost Server versions from asset inventory.
- Verify no production instance runs a version before 3.0.0.
- Inspect Legal and Support settings for unauthorized or unsafe content.
- Review change history for configuration edits to those settings.
- Document whether affected legacy systems are retired, upgraded, or isolated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2016-11073 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://mattermost.com/security-updates/CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.