CVE-2023-2514: DB username/password revealed in application logs
Published May 12, 2023
·Updated
Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization.
Affected Software
4 affected components
Mattermost Mattermost<=7.1.7
Mattermost Mattermost>=7.7.0<=7.7.3
Mattermost Mattermost>=7.8.0<=7.8.2
Mattermost Mattermost>=7.9.0<=7.9.1
Remediation
Information
Update Mattermost Server to versions 7.1.8, 7.7.4, 7.8.3, 7.9.2 or higher.
Event History
May 12, 2023
CVE Published
via MITRE·08:56 AM
Data Sourced
via MITRE·08:56 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-2514?
CVE-2023-2514 is a vulnerability in Mattermost Server that allows the DB username and password to be logged during server initialization.
2
Which version of Mattermost Server is affected by CVE-2023-2514?
Versions 7.1.7 to 7.9.1 of Mattermost Server are affected by CVE-2023-2514.
3
How severe is CVE-2023-2514?
CVE-2023-2514 has a severity rating of 7.5, which is considered high.
4
How can I fix CVE-2023-2514?
To fix CVE-2023-2514, you need to update your Mattermost Server to a version that is not affected by the vulnerability. Refer to the security updates provided by Mattermost for more information.
5
Where can I find more information about CVE-2023-2514?
You can find more information about CVE-2023-2514 and the associated security updates on the Mattermost website.