Lucene search

MattermostCVELIST:CVE-2023-2797

HistoryJun 16, 2023 - 9:03 a.m.

CVE-2023-2797 Path traversal in GitHub plugin's code preview feature

2023-06-1609:03:17

CWE-74

Mattermost

www.cve.org

github

plugin

path traversal

vulnerability

code preview

mattermost

sanitize

permalinks

attacker

private repositories

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

25.9%

JSON

Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost Github Plugin",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "7.1.9",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.8.4",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "7.1.10"
      },
      {
        "status": "unaffected",
        "version": "7.8.5"
      },
      {
        "status": "affected",
        "version": "7.10.0"
      },
      {
        "status": "unaffected",
        "version": "7.10.1"
      }
    ]
  }
]

References

mattermost.com/security-updates/

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

25.9%

JSON

Related for CVELIST:CVE-2023-2797