Skip to content
OpenAdvisories
Medium · 4.3 CVE-2023-2783 EUVD-2023-1677GHSA-455c-vqrf-mghr

App Framework does not checks for the secret provided in the incoming webhook request

Published Jun 16, 2023 · Updated Dec 6, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost App Framework Package: github.com/mattermost/mattermost-server/v6 Ecosystem: Go

Description

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost App Framework ≤ 7.8.4, ≤ 7.9.3, 7.10.0 7.10.1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server/v6 >= 7.10.0, < 7.10.1 7.10.1 GHSA-455c-vqrf-mghr
Go github.com/mattermost/mattermost-server/v6 >= 7.9.0, < 7.9.4 7.9.4 GHSA-455c-vqrf-mghr
Go github.com/mattermost/mattermost-server/v6 >= 6.0.0, < 7.8.5 7.8.5 GHSA-455c-vqrf-mghr
Go github.com/mattermost/mattermost-server/v6 < 6.0.0-20230511130429-1629a6ca7fed 6.0.0-20230511130429-1629a6ca7fed GHSA-455c-vqrf-mghr

References