PT-2023-32883 · Mattermost · Mattermost

Doyensec · Published 2023-12-29 · Updated 2024-01-05 · CVE-2023-7114

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 2.10.0 and earlier

Description The issue allows an attacker to perform CSRF attacks against the server due to the failure to sanitize deeplink paths.

Recommendations For Mattermost versions 2.10.0 and earlier, update to a version that sanitizes deeplink paths to prevent CSRF attacks. As a temporary workaround, consider restricting access to deeplink paths until a patch is available.

Fix

Path traversal

Special Elements Injection

Weakness Enumeration

CWE-22

CWE-74

Related Identifiers

CVE-2023-7114

Affected Products

Mattermost

References · 5

• https://osv.dev/vulnerability/CVE-2023-7114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7114 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://t.me/cibsecurity/73979 · Telegram Post
• https://twitter.com/CVEnew/status/1740723812025672134 · Twitter Post