CVE-2023-2797CWE-74

Path traversal in GitHub plugin's code preview feature

Low · published June 16, 2023

CVSS v3.1
3.1
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00468 · 39.5th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2023-06-16T09:03Z
EPSS history
Timeline
  • 16 JUN 09:03Z
    Path traversal in GitHub plugin's code preview feature
    cvelistv5