User password logged in audit logs
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.4%
exploitation probability
0.4%top 64% of all CVEs
observed exploitation
nono source reports it
Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Mattermost · MattermostReferences
https://mattermost.com/security-updates/