CVE-2023-2808 — Lack of URL normalization allows rendering previews for disallowed domains

CVE-2023-2808

Lack of URL normalization allows rendering previews for disallowed domains PUBLISHED

Description (CNA)

Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 before 7.1.9; affected 0 before 7.8.4; affected 0 before 7.9.3; unaffected 7.1.9; unaffected 7.8.4; unaffected 7.9.3; unaffected 7.10

CWE

CWE-20

References

https://mattermost.com/security-updates/

ADP enrichment

CVE

No English description supplied.

https://mattermost.com/security-updates/

CISA-ADP

No English description supplied.

No references supplied.