GitHub Advisoryadvisory · Go
GHSA-3wq5-3f56-v5xc Mattermost vulnerable to information disclosure
MEDIUM
Official page ↗
- Aliases
- CVE-2023-1777
- Ecosystem
- Go
- Packages
- github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost-server
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-668
- Reviewed
- 2023-04-07
Affected packages
• Go github.com/mattermost/mattermost-server/v6: >= 6.3.0, < 7.1.6 → fixed in 7.1.6
• Go github.com/mattermost/mattermost-server: >= 7.8.0, < 7.8.1 → fixed in 7.8.1
• Go github.com/mattermost/mattermost-server: >= 7.7.0, < 7.7.2 → fixed in 7.7.2
• Go github.com/mattermost/mattermost-server: >= 7.1.0, < 7.1.6 → fixed in 7.1.6
• Go github.com/mattermost/mattermost-server/v6: >= 6.0.0-20211025164829-f7a8147b825c, < 6.0.0-20230301145909-10be118d99a5 → fixed in 6.0.0-20230301145909-10be118d99a5
• Go github.com/mattermost/mattermost-server: >= 1.4.1-0.20211025164829-f7a8147b825c, < 1.4.1-0.20230301145909-10be118d99a5 → fixed in 1.4.1-0.20230301145909-10be118d99a5
Description
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.
Related
Alias · CVE (1)
- CVE-2023-1777 Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call,… vulnerability
Weakness · CWE (1)
- CWE-668 Exposure of Resource to Wrong Sphere weakness