CVE-2023-5968

MEDIUM4.9EPSS 0.15%

Mattermost password hash disclosure vulnerability

發布日:2023/11/6修改日:2025/7/22

也稱為:GHSA-r67m-mf7v-qp7j

描述

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.

受影響套件(4)

Go/github.com/mattermost/mattermost-serverfrom 0, < 5.3.2-0.20230825233148-f787fd63368a
Go/github.com/mattermost/mattermost-server/v5from 0, < 5.3.2-0.20230825233148-f787fd63368a
Go/github.com/mattermost/mattermost-server/v6>= 5.4.0-rc1, < 7.8.12
Go/github.com/mattermost/mattermost/server/v8>= 8.0.0, < 8.0.4

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

參考連結(6)