CVE-2023-4108: Mattermost fails to sanitize post metadata
4.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.35597%
CWE
Published
8/11/2023
Updated
11/9/2023
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-server/v6 | go | <= 7.8.7 | 7.8.8 |
| github.com/mattermost/mattermost-server/v6 | go | >= 7.9.0, <= 7.9.5 | 7.9.6 |
| github.com/mattermost/mattermost-server/v6 | go | >= 7.10.0, <= 7.10.3 | 7.10.4 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from unsanitized post metadata being logged during audit events. The audit.RecordPostEvent function is the logical point where post metadata would be processed for audit logging. Since the advisory explicitly mentions audit logging as the flawed mechanism, and Mattermost's architecture centralizes audit logging in the audit package, this function would handle post event metadata. The lack of sanitization before logging would occur here, matching the described CWE-200 and CWE-532 patterns. While the exact code isn't visible, the function's role in audit logging and the vulnerability's context strongly implicate it.