PT-2023-17235 · Unknown · Mattermost

Harrison Healey + 1 · Publicado 2023-03-31 · Atualizado 2024-03-06 · CVE-2023-1775

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost (affected versions not specified)

Description When running in a High Availability configuration, Mattermost fails to sanitize some of the user updated and post deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-200

CWE-668

Identificadores relacionados

BIT-MATTERMOST-2023-1775

CVE-2023-1775

GHSA-8JHH-3JF2-PFWR

Produtos afetados

Mattermost

Referências · 9

• https://osv.dev/vulnerability/BIT-mattermost-2023-1775 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1775 · Nota de Segurança
• https://mattermost.com/security-updates · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-1775 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8jhh-3jf2-pfwr · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1775 · Nota
• https://github.com.mattermost/mattermost-server · Nota
• https://t.me/cvenotify/47228 · Publicação no Telegram
• https://t.me/cibsecurity/61242 · Publicação no Telegram