PT-2023-17235 · Unknown · Mattermost

Harrison Healey + 1 · Published 2023-03-31 · Updated 2024-03-06 · CVE-2023-1775

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost (affected versions not specified)

Description When running in a High Availability configuration, Mattermost fails to sanitize some of the user updated and post deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

BIT-MATTERMOST-2023-1775

CVE-2023-1775

GHSA-8JHH-3JF2-PFWR

Affected Products

Mattermost

References · 9

• https://osv.dev/vulnerability/BIT-mattermost-2023-1775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1775 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1775 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8jhh-3jf2-pfwr · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1775 · Note
• https://github.com.mattermost/mattermost-server · Note
• https://t.me/cvenotify/47228 · Telegram Post
• https://t.me/cibsecurity/61242 · Telegram Post