Skip to content
OpenAdvisories
Medium · 4.5 CVE-2023-4108 EUVD-2023-2262GHSA-9rww-66w7-7vjx

Audit logging fails to sanitize post metadata

Published Aug 11, 2023 · Updated Oct 3, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server/v6 Ecosystem: Go

Description

Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 7.8.7, ≤ 7.9.5, ≤ 7.10.3 7.8.8

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server/v6 < 7.8.8 7.8.8 GHSA-9rww-66w7-7vjx
Go github.com/mattermost/mattermost-server/v6 >= 7.9.0, < 7.9.6 7.9.6 GHSA-9rww-66w7-7vjx
Go github.com/mattermost/mattermost-server/v6 >= 7.10.0, < 7.10.4 7.10.4 GHSA-9rww-66w7-7vjx

Advisories 2

References