GHSA-8jhh-3jf2-pfwr

ghsaUSosv

Mattermost vulnerable to information disclosure

view advisory published 2023-03-31Licence: CC-BY-4.0

When running in a High Availability configuration, Mattermost fails to sanitize some of the `user_updated` and` post_deleted` events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients. [Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00138

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-1775US	medium6.5	0.55% (46th)	—	2023-03-31
When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of se…

references

External citations — patches, advisories, analysis.

https://github.com.mattermost/mattermost-serverPACKAGE
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-1775ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan