PT-2023-17267 · Unknown · Mattermost

Jo Astoreca · Published 2023-04-17 · Updated 2024-03-06 · CVE-2023-1831

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost (affected versions not specified)

Description The issue concerns the failure to redact sensitive information from audit logs. Specifically, it affects the user password during user creation and the user password hash in other operations. This occurs when the experimental audit logging configuration is enabled, as defined in the ExperimentalAuditSettings section of the configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-319

CWE-200

Related Identifiers

BIT-MATTERMOST-2023-1831

CVE-2023-1831

Affected Products

Mattermost

References · 5

• https://osv.dev/vulnerability/BIT-mattermost-2023-1831 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1831 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1831 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1831 · Note