CVE-2023-2281
published 2023-04-25CVE-2023-2281: When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name…
PriorityP418medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.47%
38.4th percentile
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mattermost | mattermost | < 7.9 | 7.9 |
| mattermost | mattermost_server | < 7.9.0 | 7.9.0 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7qh6-7gxc-2q62: When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients
ghsa_unreviewed·2023-04-25
CVE-2023-2281 [MEDIUM] CWE-200 GHSA-7qh6-7gxc-2q62: When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.
Red Hat
mattermost-server: team data exposure during archival
vendor_redhat·2023-04-25·CVSS 3.1
CVE-2023-2281 [LOW] mattermost-server: team data exposure during archival
mattermost-server: team data exposure during archival
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.
Package: rhacm2/acm-grafana-rhel8 (Red Hat Advanced Cluster Management for Kubernetes 2) - Not affected
Package: advanced-cluster-security/rhacs-scanner-db-rhel8 (Red Hat Advanced Cluster Security 3) - Not affected
Package: advanced-cluster-security/rhacs-scanner-rhel8 (Red Hat Advanced Cluster Security 4) - Not affected
Package: openshift4/ose-grafana (Red Hat OpenShift Container Platform 4) - Not affected
Package: openshift-gitops-1/dex-rhel8 (Red Hat OpenShift GitOps) - Not affected
No detection rules found.
Exploit-DB
eScan Management Console 14.0.1400.2281 - Cross Site Scripting
exploitdb·2023-05-23·CVSS 9.0
CVE-2023-31703 [CRITICAL] eScan Management Console 14.0.1400.2281 - Cross Site Scripting
eScan Management Console 14.0.1400.2281 - Cross Site Scripting
---
# Exploit Title: eScan Management Console 14.0.1400.2281 - Cross Site Scripting
# Date: 2023-05-16
# Exploit Author: Sahil Ojha
# Vendor Homepage: https://www.escanav.com
# Software Link: https://cl.escanav.com/ewconsole.dll
# Version: 14.0.1400.2281
# Tested on: Windows
# CVE : CVE-2023-31703
*Step of Reproduction/ Proof of Concept(POC)*
1. Login into the eScan Management Console with a valid user credential.
2. Navigate to URL:
https://cl.escanav.com/ewconsole/ewconsole.dll/editUserName?usrid=4&from=banner&P=
3. Now, Inject the Cross Site Scripting Payload in "from" parameter as
shown below and a valid XSS pop up appeared.
https://cl.escanav.com/ewconsole/ewconsole.dll/editUserName?usrid=4&from=">alert(document.cookie
Exploit-DB
eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
exploitdb·2023-05-23·CVSS 7.2
CVE-2023-31702 [HIGH] eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
---
# Exploit Title: eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
# Date: 16/05/2023
# Exploit Author: Sahil Ojha
# Vendor Homepage: https://www.escanav.com
# Software Link: https://cl.escanav.com/ewconsole.dll
# Version: 14.0.1400.2281
# Tested on: Windows
# CVE : CVE-2023-31702
*Step of Reproduction/Proof of concept(POC)*
1. Login into the escan management console with a valid username and
password as root user.
2. Navigate to URL:
https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1&cnt=4176
3. Inject the payload into the UsrId parameter to confirm the SQL
injection as shown below:
https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1;WAITFOR
DELA
2023-04-25
Published