~ / search / GHSA-r67m-mf7v-qp7j

GHSA-r67m-mf7v-qp7j

Mattermost password hash disclosure vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-5968

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-server/v6 >= 5.4.0-rc1, < 7.8.12 7.8.12
Go github.com/mattermost/mattermost/server/v8 >= 8.0.0, < 8.0.4 8.0.4
Go github.com/mattermost/mattermost/server/v8 >= 8.1.0, < 8.1.3 8.1.3
Go github.com/mattermost/mattermost/server/v8 >= 9.0.0, < 9.0.1 9.0.1
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20230825233148-f787fd63368a 8.0.0-20230825233148-f787fd63368a
Go github.com/mattermost/mattermost-server/v6 < 5.3.2-0.20230825233148-f787fd63368a 5.3.2-0.20230825233148-f787fd63368a
Go github.com/mattermost/mattermost-server/v5 < 5.3.2-0.20230825233148-f787fd63368a 5.3.2-0.20230825233148-f787fd63368a
Go github.com/mattermost/mattermost-server < 5.3.2-0.20230825233148-f787fd63368a 5.3.2-0.20230825233148-f787fd63368a

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.

References

External links from the advisory. They lead to third-party sites.