5.3
CVE-2023-2808
- EPSS 0.23%
- Veröffentlicht 29.05.2023 10:15:10
- Zuletzt bearbeitet 21.11.2024 07:59:19
- Quelle responsibledisclosure@mattermo
- CVE-Watchlists
- Unerledigt
LoginLack of URL normalization allows rendering previews for disallowed domains
Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mattermost ≫ Mattermost Version >= 5.34.0 < 7.1.9
Mattermost ≫ Mattermost Version >= 7.2.0 < 7.8.4
Mattermost ≫ Mattermost Version >= 7.9.0 < 7.9.3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.23% | 0.453 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| responsibledisclosure@mattermost.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.