CVE-2023-1775

When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.

Score

CVSS 3.1 6.5 Medium

Status

Modified - responsibledisclosure@mattermost.com

Published

2023-03-31

Last modified

2024-12-06

Weaknesses

CWE-200, CWE-668

Affected products

• Mattermost (Mattermost)
• Mattermost Server (Mattermost)

References

• https://mattermost.com/security-updates/