Security readout for executives and security teams
Plain-English summary
This is a low-severity cross-site scripting issue in Mattermost 5.38 and earlier. An attacker with a user account would need a victim to interact with clipboard content, and the deployment must have disabled Mattermost’s default Content Security Policy. Successful exploitation could expose or alter limited user-visible data.
Executive priority
Handle through normal vulnerability management unless the organization runs Mattermost 5.38 or earlier with CSP disabled. The business risk is lower than remote unauthenticated compromise, but exposed collaboration systems should still be reviewed because scripting bugs can affect user trust and data handling.
Technical view
Mattermost 5.38 and earlier insufficiently sanitizes clipboard contents, enabling arbitrary web script injection in deployments that explicitly disable the default CSP. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N, reflecting network reachability, high attack complexity, low privileges, and required user interaction.
Likely exposure
Exposure is limited to Mattermost deployments running version 5.38 or earlier where the default CSP has been explicitly disabled. The source bundle does not identify affected CPEs, editions, hosting models, or exact fixed versions.
Exploitation context
No source in the bundle reports active exploitation, and the CVE is not listed as KEV. Practical exploitation appears constrained by required user assistance, attacker authentication, high complexity, and a non-default CSP configuration.
Researcher notes
Evidence is narrow: the bundle identifies CWE-79, Mattermost 5.38 and earlier, clipboard sanitization, arbitrary script injection, and dependency on disabled default CSP. It does not provide exploit artifacts, patch version, affected CPEs, or deployment-specific configuration paths.
Mitigation direction
- Confirm whether any Mattermost deployment is version 5.38 or earlier.
- Keep Mattermost’s default Content Security Policy enabled.
- Review Mattermost security updates for fixed-version guidance.
- Prioritize upgrade planning if vendor guidance identifies a fixed release.
- Avoid treating CSP disablement as an acceptable permanent configuration.
Validation and detection
- Inventory Mattermost versions across production and internal environments.
- Review configuration for explicit default CSP disablement.
- Check vendor security updates for CVE-2021-37860 details.
- Confirm affected systems require authentication and assess user exposure.
- Document compensating controls if immediate upgrade guidance is unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-37860 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N1.22.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.7LowVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://mattermost.com/security-updates/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.