CVE-2023-1777 MEDIUM

CVE-2023-1777: Information disclosure in linked message previews

Vendor Mattermost

Product Mattermost

Weakness CWE-200 · Info exposure

Published March 31, 2023

Last update December 6, 2024

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.

Key dates

02Disclosure timeline

March 31, 2023 CVE published

December 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-1777 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html

Related vulnerabilities

Identifiers

CVE CVE-2023-1777

CWE CWE-200

CVSS 6.5 / MEDIUM

Affected versions

Vendor Mattermost

Product Mattermost

Affected ≥ 6.3.0 and ≤ 7.7.1

Vendor Mattermost

Product Mattermost

Affected ≥ 6.3.0 and ≤ 7.1.5

Vendor Mattermost

Product Mattermost

Affected ≥ 6.3.0 and ≤ 7.8.0

CVE-2023-1777: Information disclosure in linked message previews

01Description

02Disclosure timeline

03References

04Related CVE