GitHub Advisoryadvisory · Go

GHSA-455c-vqrf-mghr Mattermost Server Missing Authorization vulnerability

MEDIUM Published 2023-06-16 Modified 2025-07-25 Official page ↗
Aliases
CVE-2023-2783
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server/v6
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2023-06-23

Affected packages

• Go github.com/mattermost/mattermost-server/v6: >= 7.10.0, < 7.10.1 → fixed in 7.10.1 • Go github.com/mattermost/mattermost-server/v6: >= 7.9.0, < 7.9.4 → fixed in 7.9.4 • Go github.com/mattermost/mattermost-server/v6: >= 6.0.0, < 7.8.5 → fixed in 7.8.5 • Go github.com/mattermost/mattermost-server/v6: < 6.0.0-20230511130429-1629a6ca7fed → fixed in 6.0.0-20230511130429-1629a6ca7fed

Description

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps.

Related

Alias · CVE (1)

  • CVE-2023-2783 Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References