CVE-2023-1831 : Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other o

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).

Published 2023-04-17 15:15:07

Updated 2023-04-26 20:32:58

Source Mattermost, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2023-1831

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 42 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-1831

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	Mattermost, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-1831

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: responsibledisclosure@mattermost.com (Secondary)

CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2023-1831

Mattermost » Mattermost Server
Versions from including (>=) 7.8.0 and before (<) 7.8.2
cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
Matching versions
Mattermost » Mattermost Server
Versions before (<) 7.7.3
cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
Matching versions
Mattermost » Mattermost Server » Version: 7.9.0
cpe:2.3:a:mattermost:mattermost_server:7.9.0:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2023-1831

Exploit prediction scoring system (EPSS) score for CVE-2023-1831

CVSS scores for CVE-2023-1831

CWE ids for CVE-2023-1831

References for CVE-2023-1831

Products affected by CVE-2023-1831