MEDIUM
Lack of URL normalization allows rendering previews for disallowed domains
Published May 29, 2023
5.3
MEDIUMCVSS 3.1
EPSS 0.41%
Description
Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link.
Affected products
-
- Version 0StatusaffectedConstraints<7.1.9
- Version 0StatusaffectedConstraints<7.8.4
- Version 0StatusaffectedConstraints<7.9.3
- Version 7.1.9StatusunaffectedConstraints-
- Version 7.10StatusunaffectedConstraints-
- Version 7.8.4StatusunaffectedConstraints-
- Version 7.9.3StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mattermost | Mattermost | unaffected |
|
OR
- ≥ 5.34.0 · < 7.1.9
- ≥ 7.2.0 · < 7.8.4
- ≥ 7.9.0 · < 7.9.3
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Update Mattermost to version v7.1.9, v7.8.4, v7.9.3, v7.10, or higher.
Weaknesses (1)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-34261 Advisory
- https://mattermost.com/security-updates/ Vendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-34261 | Advisory | |
| https://mattermost.com/security-updates/ | Vendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Mattermost
Published May 29, 2023
Updated Dec 6, 2024
Reserved May 19, 2023
Link CVE-2023-2808
CISA Vulnrichment
Updated Dec 6, 2024
ENISA EUVD
EUVD-2023-34261 Assigner Mattermost
Published May 29, 2023
Updated Dec 6, 2024
Exploited since n/a
Link EUVD-2023-34261