medium5.3
CVE-2023-1777
Mattermost vulnerable to information disclosure
Impact
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-server/v6 | >= 6.3.0, <= 6.7.2 | 7.1.6 |
| go | github.com/mattermost/mattermost-server | = 7.8.0 | 7.8.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | before 7.1.6 Versions 7.7.1, 7.8.0 |