GitHub Advisoryadvisory · Go

GHSA-9rww-66w7-7vjx Mattermost fails to sanitize post metadata

MEDIUM Published 2023-08-11 Modified 2023-08-11 Official page ↗
Aliases
CVE-2023-4108
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server/v6
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-532
Reviewed
2023-08-11

Affected packages

• Go github.com/mattermost/mattermost-server/v6: < 7.8.8 → fixed in 7.8.8 • Go github.com/mattermost/mattermost-server/v6: >= 7.9.0, < 7.9.6 → fixed in 7.9.6 • Go github.com/mattermost/mattermost-server/v6: >= 7.10.0, < 7.10.4 → fixed in 7.10.4

Description

Mattermost fails to sanitize post metadata during audit logging, resulting in permalinks' contents being logged.

Related

Alias · CVE (1)

  • CVE-2023-4108 Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References