Password Disclosure

2023-05-1904:07:13

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

mattermost

server

vulnerability

password disclosure

audit logs

experimental

audit logging configuration

user passwords

user hashes

software

0.001 Low

EPSS

Percentile

43.0%

JSON

github.com/mattermost/mattermost-server is vulnerable to Password Disclosure. The vulnerability exists because the user passwords and user hashes were revealed in audit logs if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).

CPENameOperatorVersion
github.com/mattermost/mattermost-servereqv7.9.0
github.com/mattermost/mattermost-serverlev7.7.2
github.com/mattermost/mattermost-serverlecloud-2023-03-15-1
github.com/mattermost/mattermost-serverlev7.8.1
github.com/mattermost/mattermost-servereqv7.9.0
github.com/mattermost/mattermost-serverlev7.7.2
github.com/mattermost/mattermost-serverlecloud-2023-03-15-1
github.com/mattermost/mattermost-serverlev7.8.1

Name	Operator	Version
github.com/mattermost/mattermost-server	eq	v7.9.0
github.com/mattermost/mattermost-server	le	v7.7.2
github.com/mattermost/mattermost-server	le	cloud-2023-03-15-1
github.com/mattermost/mattermost-server	le	v7.8.1
github.com/mattermost/mattermost-server	eq	v7.9.0
github.com/mattermost/mattermost-server	le	v7.7.2
github.com/mattermost/mattermost-server	le	cloud-2023-03-15-1
github.com/mattermost/mattermost-server	le	v7.8.1