CVE-2023-2281

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Apr 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-228127.4SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attaCVE-2023-228134.3A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and AndroidCVE-2023-228149.8An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carryCVE-2023-228156.7Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute CVE-2023-228168.8A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attaCVE-2023-228175.5Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS adCVE-2023-228187.8Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers witCVE-2023-228194.9An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amountCVE-2023-22826.5Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticCVE-2023-22836.5A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signaturCVE-2023-228327.5The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configuratioCVE-2023-228336.5Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users withi
CVE-2023-2281: Medium severity, CVSS 4.3 | Vulnix