CVE-2023-5968: 
Mattermost vulnerability analysis and mitigation

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. This vulnerability was assigned CVE-2023-5968 and affects multiple versions of Mattermost including versions up to 7.8.11, versions 8.0.0 to 8.0.3, versions 8.1.0 to 8.1.2, and version 9.0.0 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The weakness has been categorized under CWE-116 (Improper Encoding or Escaping of Output) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The vulnerability exposes sensitive information in the form of password hashes to unauthorized actors when updating usernames. This exposure of cryptographic material could potentially be used in offline password cracking attempts (NVD).

Users should upgrade to the latest version of Mattermost that contains the fix for this vulnerability. The issue has been addressed in subsequent releases after the affected versions (NVD).