CVE-2023-2783: App Framework does not checks for the secret provided in the incoming webhook request
Published Jun 16, 2023
·Updated
Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps.
Affected Software
7 affected componentsFixes available
Mattermost Mattermost>=7.8.0<=7.8.4
Mattermost Mattermost>=7.9.0<=7.9.3
Mattermost Mattermost=7.10.0
go/github.com/mattermost/mattermost-server/v6<6.0.0-20230511130429-1629a6ca7fed
6.0.0-20230511130429-1629a6ca7fed
go/github.com/mattermost/mattermost-server/v6>=6.0.0<7.8.5
7.8.5
go/github.com/mattermost/mattermost-server/v6>=7.9.0<7.9.4
7.9.4
go/github.com/mattermost/mattermost-server/v6=7.10.0
7.10.1
Remediation
Information
Update Mattermost Server to versions Versions 7.8.5, 7.9.4, 7.10.1 or higher.
Event History
Jun 16, 2023
CVE Published
via MITRE·08:39 AM
Data Sourced
via MITRE·08:39 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·09:30 AM
Data Sourced
via GitHub·09:30 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this Mattermost Apps Framework vulnerability?
The vulnerability ID for this Mattermost Apps Framework vulnerability is CVE-2023-2783.
2
What is the severity of CVE-2023-2783?
CVE-2023-2783 has a severity level of medium with a CVSS score of 4.3.
3
What is the affected software for CVE-2023-2783?
The affected software for CVE-2023-2783 is Mattermost version 7.8.0 to 7.8.4, 7.9.0 to 7.9.3, and 7.10.0.
4
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by providing an incorrect secret in the incoming webhook request, allowing them to modify the contents of the post sent by the Apps.
5
Is there a fix available for CVE-2023-2783?
Yes, Mattermost has released security updates to address CVE-2023-2783. It is recommended to update to the latest version of Mattermost.