Medium severity · published Oct 17, 2023
CVE-2023-5339
Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Mattermost Desktop · Mattermost
through 5.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5339
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5339
Vendor Advisory
https://mattermost.com/security-updates
More from Mattermost Desktop
9.8
CVE-2016-11064
An issue was discovered in Mattermost Desktop App before 3.4.0
9.8
CVE-2019-20856
An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS
8.8
CVE-2019-20861
An issue was discovered in Mattermost Desktop App before 4.2.2
7.8
CVE-2024-39613
Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the…
7.7
CVE-2026-6517
Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed