CVE-2023-45223 — Sensitive Information Exposure in Mattermost Mattermost-server V6

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.4%
top 42.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Mattermost Mattermost-server V6Github.com Mattermost Mattermost Server V8Mattermost
Timeline
PublishedNov 27

Description

Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5mattermost/mattermost7.8.12+1
▶NVDmattermost/mattermost8.0.0 — 8.1.3+1

🔴Vulnerability Details

3
OSV
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability↗2023-11-27
▶
CVEList
Users full name disclosure through Mattermost Boards with Show Full Name Option disabled↗2023-11-27
▶
GHSA
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability↗2023-11-27
▶
CVE-2023-45223 — Sensitive Information Exposure | cvebase