CVE-2023-35075: 
Mattermost vulnerability analysis and mitigation

CVE-2023-35075 is a vulnerability in Mattermost that affects versions up to 7.8.12 and versions 8.0.0 through 8.1.3. The vulnerability stems from the webapp's failure to properly use innerText/textContent when setting channel names during autocomplete operations (NVD).

The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). It has received varying CVSS v3.1 scores: NIST assigned a medium severity score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), while Mattermost assigned a low severity score of 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) (NVD).

The vulnerability allows an attacker to inject HTML into a victim's page by creating a channel name containing valid HTML. However, it's specifically noted that XSS (Cross-Site Scripting) exploitation is not possible through this vulnerability (NVD).

The vulnerability requires network access and low privileges to exploit. While the attack complexity is rated differently by NIST and Mattermost (Low vs High), user interaction is generally required for successful exploitation (NVD).

Users should upgrade to Mattermost version 8.1.4 or later to address this vulnerability. The fix has been implemented in the latest versions of the software (FortiGuard).