Lucene search
HistoryJul 17, 2023 - 4:15 p.m.
CVE-2023-3577
mattermost
ssrf
vulnerability
cve-2023-3577
nvd
security
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.5 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.9%
Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF.
Affected configurations
Node
mattermostmattermost_serverRange7.8.0–7.8.7
ORmattermostmattermost_serverRange7.10.0–7.10.3
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "7.9.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.8.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.10.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.8.7"
},
{
"status": "unaffected",
"version": "7.10.3"
}
]
}
]References
Related
osv
osv
CVE-2023-3577
2023-07-17 16:15:10
BIT-mattermost-2023-3577
2024-03-06 11:01:13
nvd
nvd
CVE-2023-3577
2023-07-17 16:15:10
cvelist
cvelist
prion
prion
Server side request forgery (ssrf)
2023-07-17 16:15:00
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.5 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.9%
Related for CVE-2023-3577