CVE-2023-2808

Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link.

Score

CVSS 3.1 5.3 Medium

Status

Modified - responsibledisclosure@mattermost.com

Published

2023-05-29

Last modified

2024-12-06

Weaknesses

CWE-20

Affected products

• Mattermost (Mattermost)

References

• https://mattermost.com/security-updates/