CVE-2023-2281

EPSS 0.32%
Published 25.04.2023 14:15:09
Last modified 21.11.2024 07:58:18
Source responsibledisclosure@mattermo
Teams watchlist Login
Open Login

When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Mattermost ≫ Mattermost Server Version < 7.9.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.32%	0.518

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
responsibledisclosure@mattermost.com	3.1	1.6	1.4	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://mattermost.com/security-updates/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-2281

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-2281

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-2281

EUVD