CVE-2016-11071

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-110726.5An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.CVE-2016-110736.1An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.CVE-2016-110749.8An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.CVE-2016-110755.3An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.CVE-2016-110765.3An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.CVE-2016-110772.7An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name anCVE-2016-110786.5An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fieldCVE-2016-110796.1An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.CVE-2016-11087.5Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer CVE-2016-110804.3An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.CVE-2016-110814.3An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.CVE-2016-110826.1An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
CVE-2016-11071: Medium severity, CVSS 6.1 | Vulnix