CVE-2023-1831

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-1831
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1831.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-1831
Aliases
Published
2023-04-17T14:21:13.233Z
Modified
2026-07-15T02:07:54.909012533Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
User password logged in audit logs
Details

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "7.7.2"
                },
                {
                    "last_affected": "7.8.1"
                },
                {
                    "last_affected": "7.9.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "Mattermost",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1831.json"
}
References

Affected packages

Git / github.com/mattermost/mattermost

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
975848b862e33caa1b8ce4db752bea1f0f15e258
Introduced
f14c24391ca84740d90a29ec8b67579326eaa236
Fixed
2e0b83e9e86eee88578f8e0a9bb8215aa13bb46a
Introduced
c4d8c1450ab2b9538bbc2690ca1ee865567a5888
Last affected
c4d8c1450ab2b9538bbc2690ca1ee865567a5888
Database specific 
{
    "cpe": [
        "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:7.9.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.7.3"
        },
        {
            "introduced": "7.8.0"
        },
        {
            "fixed": "7.8.2"
        },
        {
            "introduced": "7.9.0"
        },
        {
            "last_affected": "7.9.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

7.*
7.9.0
Other
cloud-2022-07-20-1
cloud-2022-08-10-1
cloud-2022-09-08-1
cloud-2022-10-06-1
cloud-2022-11-11-1
cloud-2022-11-24-1
v0.*
v0.5.0
v4.*
v4.10.0-rc1
v4.2.0-rc1
v4.3.0-rc1
v4.4.0-rc1
v4.5.0-rc1
v4.6.0-rc1
v4.6.0-rc2
v4.7.0-rc1
v4.8.0-rc1
v4.9.0-rc1
v5.*
v5.0.0-rc1
v5.1.0-rc1
v5.2.0-rc1
v5.2.0-rc2
v7.*
v7.7.0
v7.7.1
v7.7.2
v7.8.0
v7.8.1
v7.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1831.json"