GitHub Advisoryadvisory · Go

GHSA-9w4v-9c99-hv7r Mattermost Server exposes sensitive information via its System Console UI

MEDIUM Published 2022-05-24 Modified 2025-10-22 Official page ↗
Aliases
CVE-2016-11078
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-10-22

Affected packages

• Go github.com/mattermost/mattermost-server: < 3.0.0 → fixed in 3.0.0

Description

An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.

Related

Alias · CVE (1)

  • CVE-2016-11078 An issue was discovered in Mattermost Server before 3.0.0. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References