CVE-2023-5968: Password hash in response body after username update
Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5968?
The severity of CVE-2023-5968 is medium with a score of 4.9.
How does Mattermost fail to sanitize the user object when updating the username in CVE-2023-5968?
Mattermost fails to properly sanitize the user object, resulting in the password hash being included in the response body.
Which versions of Mattermost are affected by CVE-2023-5968?
Mattermost versions 9.0.0, 8.1.0 to 8.1.3, 8.0.0 to 8.0.4, and 7.8.12 are affected by CVE-2023-5968.
How can I fix CVE-2023-5968 in Mattermost?
To fix CVE-2023-5968 in Mattermost, upgrade to version 9.0.1.
Where can I find more information about CVE-2023-5968?
More information about CVE-2023-5968 can be found at the following references: [Mattermost Security Updates](https://mattermost.com/security-updates), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-5968), [GitHub Advisory](https://github.com/advisories/GHSA-r67m-mf7v-qp7j).