CVE-2023-1831

HIGH

Mattermost < 7.7.3 - Sensitive Information Exposure in Audit Logs

Title source: llm

Description

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).

References (1)

Core 1

Core References

Vendor Advisory

https://mattermost.com/security-updates/

Scores

CVSS v3 7.2

EPSS 0.0016

EPSS Percentile 36.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-319 CWE-200

Status published

Products (2)

mattermost/mattermost_server 7.9.0

mattermost/mattermost_server < 7.7.3

Published Apr 17, 2023

Tracked Since Feb 18, 2026