CVE-2023-1775 — Sensitive Information Exposure in Mattermost

CWE-200 — Sensitive Information ExposureCWE-668 — Resource Exposure5 documents5 sources
Severity
6.5MEDIUMNVD
CNA4.3
EPSS
0.3%
top 48.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
MattermostGithub.com Mattermost Mattermost-serverGithub.com Mattermost Mattermost-server V5+2 more
Timeline
PublishedMar 31
Latest updateSep 6

Description

When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5mattermost/mattermost3.3.0 — 7.8.0+2

🔴Vulnerability Details

3
GHSA
Mattermost vulnerable to information disclosure↗2023-03-31
▶
OSV
Mattermost vulnerable to information disclosure↗2023-03-31
▶
CVEList
Unsanitized events sent over Websocket to regular users in a High Availability environment↗2023-03-31
▶

🕵️Threat Intelligence

1
Talos
Eight vulnerabilities in Open Automation Software Platform could lead to information disclosure, improper authentication↗2023-09-06
▶
CVE-2023-1775 — Sensitive Information Exposure | cvebase