PT-2023-18709 · Unknown · Mattermost

Published 2023-04-25 · Updated 2024-03-06 · CVE-2023-2281

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost (affected versions not specified)

Description The issue arises when archiving a team, as Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-MATTERMOST-2023-2281

CVE-2023-2281

Affected Products

Mattermost

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-2281 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2023-2281 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2281 · Vendor Advisory
• https://t.me/cibsecurity/62810 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2281 · Note