medium4.9
CVE-2023-5968
Mattermost password hash disclosure vulnerability
Impact
Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/v8 | >= 8.0.0, < 8.0.4 | 8.0.4 |
| go | github.com/mattermost/mattermost-server/v6 | >= 5.4.0-rc1, < 7.8.12 | 7.8.12 |
| go | github.com/mattermost/mattermost-server/v5 | < 5.3.2-0.20230825233148-f787fd63368a | 5.3.2-0.20230825233148-f787fd63368a |
| go | github.com/mattermost/mattermost-server | < 5.3.2-0.20230825233148-f787fd63368a | 5.3.2-0.20230825233148-f787fd63368a |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost | through 7.8.11 from 8.0.0 through 8.0.3 from 8.1.0 through 8.1.2 Version 9.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://mattermost.com/security-updates
- https://github.com/advisories/GHSA-r67m-mf7v-qp7j
- https://nvd.nist.gov/vuln/detail/CVE-2023-5968
- https://github.com/mattermost/mattermost/pull/24362
- https://github.com/mattermost/mattermost/pull/24566
- https://github.com/mattermost/mattermost/commit/698f4a97da564e2c1f2bf1fbd01755cefa3b7881