Low severity · published Nov 2, 2023
CVE-2023-5920
Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Mattermost Desktop · Mattermost
before 5.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5920
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5920
Vendor Advisory
https://mattermost.com/security-updates
More from Mattermost Desktop
9.8
CVE-2016-11064
An issue was discovered in Mattermost Desktop App before 3.4.0
9.8
CVE-2019-20856
An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS
8.8
CVE-2019-20861
An issue was discovered in Mattermost Desktop App before 4.2.2
7.8
CVE-2024-39613
Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the…
7.7
CVE-2026-6517
Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed