CVE-2023-5968

Summary

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. 

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost0 <= 7.8.11affected
MattermostMattermost0 <= 8.0.3affected
MattermostMattermost0 <= 8.1.2affected
MattermostMattermost0 <= 9.0.0affected
MattermostMattermost7.8.12unaffected
MattermostMattermost8.0.4unaffected
MattermostMattermost8.1.3unaffected
MattermostMattermost9.0.1unaffected

Weaknesses

  • CWE-200: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References