VULNERABILITY INTELLIGENCE

CVE-2023-1831

CVSS score7.2 HIGH
EPSS probability0.42%
CISA KEVNot currently listed
Published2023-04-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-200
  • nvd@nist.gov: CWE-319

Primary references