| id: GO-ID-PENDING |
| modules: |
| - module: github.com/mattermost/mattermost-server |
| non_go_versions: |
| - introduced: 7.1.0 |
| fixed: 7.1.6 |
| - introduced: 7.7.0 |
| fixed: 7.7.2 |
| - introduced: 7.8.0 |
| fixed: 7.8.1 |
| vulnerable_at: 9.8.0+incompatible |
| - module: github.com/mattermost/mattermost-server/v6 |
| versions: |
| - introduced: 6.3.0 |
| fixed: 7.1.6 |
| summary: Mattermost vulnerable to information disclosure in github.com/mattermost/mattermost-server |
| description: |- |
| Mattermost allows an attacker to request a preview of an existing message when |
| creating a new message via the createPost API call, disclosing the contents of |
| the linked message. |
| cves: |
| - CVE-2023-1777 |
| ghsas: |
| - GHSA-3wq5-3f56-v5xc |
| references: |
| - advisory: https://github.com/advisories/GHSA-3wq5-3f56-v5xc |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-1777 |
| - web: https://mattermost.com/security-updates/ |
| notes: |
| - fix: 'github.com/mattermost/mattermost-server/v6: could not add vulnerable_at: version 7.1.6 does not exist' |
| - lint: 'modules[1] "github.com/mattermost/mattermost-server/v6": version 7.1.6 does not exist' |
| source: |
| id: GHSA-3wq5-3f56-v5xc |
| created: 1999-01-01T00:00:00Z |
| review_status: UNREVIEWED |
