CVE-2023-4108: Audit logging fails to sanitize post metadata
First published: Fri Aug 11 2023(Updated: )
Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged
Credit: responsibledisclosure@mattermost.com responsibledisclosure@mattermost.com responsibledisclosure@mattermost.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mattermost Mattermost | >=7.8.0<7.8.8 | |
| Mattermost Mattermost | >=7.9.0<7.9.6 | |
| Mattermost Mattermost | >=7.10.0<7.10.4 | |
| go/github.com/mattermost/mattermost-server/v6 | >=7.10.0<=7.10.3 | 7.10.4 |
| go/github.com/mattermost/mattermost-server/v6 | >=7.9.0<=7.9.5 | 7.9.6 |
| go/github.com/mattermost/mattermost-server/v6 | <=7.8.7 | 7.8.8 |
| >=7.8.0<7.8.8 | ||
| >=7.9.0<7.9.6 | ||
| >=7.10.0<7.10.4 |
Remedy
Update Mattermost Server to versions 7.8.8, 7.9.6, 7.10.4 or higher.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for Mattermost fails to sanitize post metadata during audit logging?
The vulnerability ID is CVE-2023-4108.
What is the severity of CVE-2023-4108?
The severity of CVE-2023-4108 is high with a score of 7.5.
How does the vulnerability in Mattermost affect the system?
The vulnerability in Mattermost allows unsanitized post metadata to be logged, potentially exposing sensitive information in permalinks.
Which versions of Mattermost are affected by CVE-2023-4108?
Versions 7.10.0 through 7.10.3, 7.9.0 through 7.9.5, and 7.8.0 through 7.8.7 of Mattermost are affected.
How can I fix the CVE-2023-4108 vulnerability in Mattermost?
To fix the CVE-2023-4108 vulnerability, update Mattermost to version 7.10.4, 7.9.6, or 7.8.8.
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-9rww-66w7-7vjx
- alias/CVE-2023-4108
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/title
- agent/remedy
- agent/first-publish-date
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- agent/trending
- vendor/mattermost
- canonical/mattermost mattermost
- version/mattermost mattermost/7.8.0
- version/mattermost mattermost/7.9.0
- version/mattermost mattermost/7.10.0
- package-manager/go