CVE-2023-4108: Audit logging fails to sanitize post metadata
Published Aug 11, 2023
·Updated
Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged
Other sources
Mattermost fails to sanitize post metadata during audit logging, resulting in permalinks' contents being logged.
Affected Software
6 affected componentsFixes available
go/github.com/mattermost/mattermost-server/v6>=7.10.0<=7.10.3
7.10.4
go/github.com/mattermost/mattermost-server/v6>=7.9.0<=7.9.5
7.9.6
go/github.com/mattermost/mattermost-server/v6<=7.8.7
7.8.8
Mattermost Mattermost>=7.8.0<7.8.8
Mattermost Mattermost>=7.9.0<7.9.6
Mattermost Mattermost>=7.10.0<7.10.4
Remediation
Information
Update Mattermost Server to versions 7.8.8, 7.9.6, 7.10.4 or higher.
Event History
Aug 11, 2023
CVE Published
via MITRE·06:12 AM
Data Sourced
via MITRE·06:12 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
09:30 AM
Frequently Asked Questions
1
What is the vulnerability ID for Mattermost fails to sanitize post metadata during audit logging?
The vulnerability ID is CVE-2023-4108.
2
What is the severity of CVE-2023-4108?
The severity of CVE-2023-4108 is high with a score of 7.5.
3
How does the vulnerability in Mattermost affect the system?
The vulnerability in Mattermost allows unsanitized post metadata to be logged, potentially exposing sensitive information in permalinks.
4
Which versions of Mattermost are affected by CVE-2023-4108?
Versions 7.10.0 through 7.10.3, 7.9.0 through 7.9.5, and 7.8.0 through 7.8.7 of Mattermost are affected.
5
How can I fix the CVE-2023-4108 vulnerability in Mattermost?
To fix the CVE-2023-4108 vulnerability, update Mattermost to version 7.10.4, 7.9.6, or 7.8.8.