CVE-2023-1831 — Sensitive Information Exposure in Server

CWE-200 — Sensitive Information ExposureCWE-319 — Cleartext Transmission of Sensitive Info3 documents3 sources
Severity
7.5HIGHNVD
CNA7.2
EPSS
0.1%
top 72.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mattermost ServerMattermost
Timeline
PublishedApr 17
Latest updateJul 6

Description

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDmattermost/mattermost_server7.8.0 — 7.8.2+2
▶CVEListV5mattermost/mattermost7.7.2+2

🔴Vulnerability Details

2
GHSA
GHSA-4683-xj3v-wqvf: Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental a↗2023-07-06
▶
CVEList
User password logged in audit logs↗2023-04-17
▶
CVE-2023-1831 — Sensitive Information Exposure | cvebase