Skip to content
OpenAdvisories
Medium · 4.9 Public exploit CVE-2023-5968 EUVD-2023-3022GHSA-r67m-mf7v-qp7j

Password hash in response body after username update

Published Nov 6, 2023 · Updated Sep 12, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. 

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 7.8.11, ≤ 8.0.3, ≤ 8.1.2, ≤ 9.0.0 7.8.12

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Curtail-Inc/hello-ReGrade-security ★ 0 · Jul 4, 2026

    Find the vulnerability your tests were never written to catch. A ReGrade demo modeling CVE-2023-5968: catch a password-hash leak by comparing an app to itself.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server < 5.3.2-0.20230825233148-f787fd63368a 5.3.2-0.20230825233148-f787fd63368a GHSA-r67m-mf7v-qp7j
Go github.com/mattermost/mattermost-server/v5 < 5.3.2-0.20230825233148-f787fd63368a 5.3.2-0.20230825233148-f787fd63368a GHSA-r67m-mf7v-qp7j
Go github.com/mattermost/mattermost-server/v6 >= 5.4.0-rc1, < 7.8.12 7.8.12 GHSA-r67m-mf7v-qp7j
Go github.com/mattermost/mattermost-server/v6 < 5.3.2-0.20230825233148-f787fd63368a 5.3.2-0.20230825233148-f787fd63368a GHSA-r67m-mf7v-qp7j
Go github.com/mattermost/mattermost/server/v8 >= 8.0.0, < 8.0.4 8.0.4 GHSA-r67m-mf7v-qp7j
Go github.com/mattermost/mattermost/server/v8 >= 8.1.0, < 8.1.3 8.1.3 GHSA-r67m-mf7v-qp7j
Go github.com/mattermost/mattermost/server/v8 >= 9.0.0, < 9.0.1 9.0.1 GHSA-r67m-mf7v-qp7j
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20230825233148-f787fd63368a 8.0.0-20230825233148-f787fd63368a GHSA-r67m-mf7v-qp7j

References