Lucene search

[email protected]CVE-2023-1421

HistoryMar 15, 2023 - 11:15 p.m.

CVE-2023-1421

2023-03-1523:15:09

CWE-79

[email protected]

web.nvd.nist.gov

security

vulnerability

xss

mattermost

oauth

ajax

nvd

cve-2023-1421

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

26.1%

JSON

A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter.

CPENameOperatorVersion
mattermost:mattermost_servermattermost mattermost serverlt7.7.0
mattermost:mattermost_servermattermost mattermost servereq6.3.7
mattermost:mattermost_servermattermost mattermost servereq6.6.0
mattermost:mattermost_servermattermost mattermost servereq7.1.0
mattermost:mattermost_servermattermost mattermost servereq5.38.4
mattermost:mattermost_servermattermost mattermost servereq6.2.1
mattermost:mattermost_servermattermost mattermost servereq5.32.0
mattermost:mattermost_servermattermost mattermost servereq7.1.3
mattermost:mattermost_servermattermost mattermost servereq6.7.2
mattermost:mattermost_servermattermost mattermost servereq5.33.2

CPE	Name	Operator	Version
mattermost:mattermost_server	mattermost mattermost server	lt	7.7.0
mattermost:mattermost_server	mattermost mattermost server	eq	6.3.7
mattermost:mattermost_server	mattermost mattermost server	eq	6.6.0
mattermost:mattermost_server	mattermost mattermost server	eq	7.1.0
mattermost:mattermost_server	mattermost mattermost server	eq	5.38.4
mattermost:mattermost_server	mattermost mattermost server	eq	6.2.1
mattermost:mattermost_server	mattermost mattermost server	eq	5.32.0
mattermost:mattermost_server	mattermost mattermost server	eq	7.1.3
mattermost:mattermost_server	mattermost mattermost server	eq	6.7.2
mattermost:mattermost_server	mattermost mattermost server	eq	5.33.2

Rows per page:

1-10 of 1051

References

mattermost.com/security-updates/

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

26.1%

JSON

Related for CVE-2023-1421

hackerone1 veracode1 osv2 prion1