Mattermost password hash disclosure vulnerability
Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-5968US | medium4.9 | Exploit | ||
Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.
| ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/mattermost/mattermostPACKAGE
- https://github.com/mattermost/mattermost/commit/698f4a97da564e2c1f2bf1fbd01755cefa3b7881WEB
- https://github.com/mattermost/mattermost/pull/24362WEB
- https://github.com/mattermost/mattermost/pull/24566WEB
- https://mattermost.com/security-updatesWEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-5968ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan