CVE-2023-3585

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
MattermostMattermost<= 7.8.6; <= 7.9.4; <= 7.10.2

References

Timeline

Published
Jul 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-358507.2SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administCVE-2023-358517.5SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL cCVE-2023-358527.5In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule,CVE-2023-358539.8In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6CVE-2023-358549.8Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session CVE-2023-358559.8A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying thCVE-2023-358569.8A buffer overflow in Nintendo Mario Kart Wii RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code CVE-2023-358579.8In Siren Investigate before 13.2.2, session keys remain active even after logging out.CVE-2023-358585.3XPath Injection vulnerabilities in the blog and RSS functions of Modern Campus - Omni CMS 2023.1 allow a remote, unauthenticated attacker toCVE-2023-358596.1A Reflected Cross-Site Scripting (XSS) vulnerability in the blog function of Modern Campus - Omni CMS 2023.1 allows a remote attacker to injCVE-2023-35865.4Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previouslCVE-2023-358605.3A Directory Traversal vulnerability in Modern Campus - Omni CMS 2023.1 allows a remote, unauthenticated attacker to enumerate file system in
CVE-2023-3585: Medium severity, CVSS 4.3 | Vulnix