CVE-2023-2281: Archiving a team broadcasts unsanitized data over WebSockets
First published: Tue Apr 25 2023(Updated: )
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.
Credit: responsibledisclosure@mattermost.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mattermost Mattermost Server | <7.9.0 |
Remedy
Update Mattermost to version v7.9 or higher.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-2281.
What is the severity of CVE-2023-2281?
The severity of CVE-2023-2281 is medium with a severity value of 4.3.
How does the vulnerability CVE-2023-2281 impact Mattermost?
The vulnerability CVE-2023-2281 impacts Mattermost by allowing currently connected clients to see sensitive data about archived teams.
How can I fix the vulnerability CVE-2023-2281?
To fix the vulnerability CVE-2023-2281, upgrade to a version of Mattermost Server that is later than 7.9.0.
Where can I find more information about the vulnerability CVE-2023-2281?
You can find more information about the vulnerability CVE-2023-2281 on the Mattermost security updates page.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/author
- agent/references
- agent/remedy
- agent/weakness
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/mattermost
- canonical/mattermost mattermost server