CVE-2023-2797 : Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting

Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel.

Published 2023-06-16 10:15:09

Updated 2023-06-26 17:45:05

Source Mattermost, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-2797

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-2797

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
3.1	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N	1.6	1.4	Mattermost, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2023-2797

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by:

nvd@nist.gov (Primary)
responsibledisclosure@mattermost.com (Secondary)

Products affected by CVE-2023-2797

Mattermost » Mattermost
Versions from including (>=) 7.1.0 and up to, including, (<=) 7.1.9
cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*
Matching versions
Mattermost » Mattermost
Versions from including (>=) 7.8.0 and up to, including, (<=) 7.8.4
cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*
Matching versions
Mattermost » Mattermost » Version: 7.10.0
cpe:2.3:a:mattermost:mattermost:7.10.0:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2023-2797

Exploit prediction scoring system (EPSS) score for CVE-2023-2797

CVSS scores for CVE-2023-2797

CWE ids for CVE-2023-2797

References for CVE-2023-2797

Products affected by CVE-2023-2797