CVE-2023-1777

Summary

Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost6.3.0 <= 7.7.1affected
MattermostMattermost6.3.0 <= 7.1.5affected
MattermostMattermost6.3.0 <= 7.8.0affected
MattermostMattermost7.8.1unaffected
MattermostMattermost7.7.2unaffected
MattermostMattermost7.1.6unaffected

Weaknesses

  • CWE-200: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References