CVE-2016-11065

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.3.0

Description: An issue was discovered that allows an attacker to use the WebSocket feature to send pop-up messages to users or change a post's appearance.

Recommendations: For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue. As a temporary workaround, consider disabling the WebSocket feature until a patch is available. Restrict access to the WebSocket endpoint to minimize the risk of exploitation. Avoid using the WebSocket feature in the affected API endpoint until the issue is resolved.