CVE-2023-1775
published 2023-03-31CVE-2023-1775: When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users…
PriorityP433medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.55%
42.4th percentile
When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 3.3.0 < 7.1.6 | 7.1.6 |
| github.com | mattermost_mattermost-server | >= 7.1.0 < 7.1.6 | 7.1.6 |
| github.com | mattermost_mattermost-server | >= 7.7.0 < 7.7.2 | 7.7.2 |
| github.com | mattermost_mattermost-server_v5 | >= 5.0.0 < 7.1.6 | 7.1.6 |
| github.com | mattermost_mattermost-server_v6 | >= 6.0.0 < 7.1.6 | 7.1.6 |
| mattermost | mattermost | >= 3.3.0 < 7.8.0 | 7.8.0 |
| mattermost | mattermost | 3.3.0 – 7.7.1 | — |
| mattermost | mattermost_server | < 7.1.6 | 7.1.6 |
| mattermost | mattermost_server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mattermost vulnerable to information disclosure
ghsa·2023-03-31
CVE-2023-1775 [MEDIUM] CWE-668 Mattermost vulnerable to information disclosure
Mattermost vulnerable to information disclosure
When running in a High Availability configuration, Mattermost fails to sanitize some of the `user_updated` and` post_deleted` events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.
[Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00138
OSV
Mattermost vulnerable to information disclosure
osv·2023-03-31
CVE-2023-1775 [MEDIUM] Mattermost vulnerable to information disclosure
Mattermost vulnerable to information disclosure
When running in a High Availability configuration, Mattermost fails to sanitize some of the `user_updated` and` post_deleted` events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.
[Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00138
No detection rules found.
No public exploits indexed.
2023-03-31
Published