CVE-2023-1775

MEDIUM6.5EPSS 0.31%

Mattermost vulnerable to information disclosure

Published: 3/31/2023Modified: 12/6/2023

Also known as:GHSA-8jhh-3jf2-pfwrBIT-mattermost-2023-1775

Description

When running in a High Availability configuration, Mattermost fails to sanitize some of the `user_updated` and` post_deleted` events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients. [Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00138

Affected packages (4)

Bitnami/mattermostfrom 0, < 7.1.6 | >= 7.7.1, <= 7.7.1
Go/github.com/mattermost/mattermost-server>= 3.3.0, < 7.1.6
Go/github.com/mattermost/mattermost-server/v5>= 5.0.0, < 7.1.6
Go/github.com/mattermost/mattermost-server/v6>= 6.0.0, < 7.1.6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-1775
PATCHhttps://github.com.mattermost/mattermost-server
WEBhttps://mattermost.com/security-updates
WEBhttps://mattermost.com/security-updates/