CVE-2023-5968mediumCWE-200

Password hash in response body after username update

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 0.5%

exploitation probability

0.5%top 57% of all CVEs

observed exploitation

nono source reports it

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

References