CVE-2023-4108

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

VendorProductVersions
MattermostMattermost<= 7.8.7; <= 7.9.5; <= 7.10.3

References

Timeline

Published
Aug 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-410806.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache TomCVE-2023-410817.5Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a confCVE-2023-410824.4Null pointer dereference for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable deniaCVE-2023-410849.8Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions tCVE-2023-410857.5When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate.  Note: Software versions which have reached ECVE-2023-410868.8Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious pageCVE-2023-410886.5The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with acceCVE-2023-410898.8The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate userCVE-2023-41094.8The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.CVE-2023-410906.4Race condition in some Intel(R) MAS software before version 2.3 may allow a privileged user to potentially enable escalation of privilege viCVE-2023-410917.8Uncontrolled search path for some Intel(R) MPI Library Software before version 2021.11 may allow an authenticated user to potentially enableCVE-2023-410927.6Unchecked return value in SDM firmware for Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs before version 23.3 may allow an authenticated us
CVE-2023-4108: High severity, CVSS 7.5 | Vulnix