Vulnerability · Published Mar 31, 2023 · Assigned by Mattermost
CVE-2023-1777Information disclosure in linked message previews
Medium 6.5
In plain English
A medium-severity information exposure in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 54.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | 7.8.1 | GHSA-3wq5-3f56-v5xc |
| Go | github.com/mattermost/mattermost-server | 7.7.2 | GHSA-3wq5-3f56-v5xc |
| Go | github.com/mattermost/mattermost-server | 7.1.6 | GHSA-3wq5-3f56-v5xc |
| Go | github.com/mattermost/mattermost-server | 1.4.1-0.20230301145909-10be118d99a5 | GHSA-3wq5-3f56-v5xc |
| Go | github.com/mattermost/mattermost-server/v6 | 7.1.6 | GHSA-3wq5-3f56-v5xc |
| Go | github.com/mattermost/mattermost-server/v6 | 6.0.0-20230301145909-10be118d99a5 | GHSA-3wq5-3f56-v5xc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 6.3.0 – through 7.7.16.3.0 – through 7.1.56.3.0 – through 7.8.0 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N