PT-2023-17235 · Unknown · Mattermost

Harrison Healey

+1

·

CVE-2023-1775

·

Published

2023-03-31

·

Updated

2024-03-06

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Mattermost (affected versions not specified)
Description When running in a High Availability configuration, Mattermost fails to sanitize some of the user updated and post deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-668CWE-200

Related Identifiers

BIT-MATTERMOST-2023-1775
CVE-2023-1775
GHSA-8JHH-3JF2-PFWR

Affected Products

Mattermost