title: User password logged in audit logs
description: Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 7.7.2, status: affected, version: 0, versionType: semver
lessThanOrEqual: 7.8.1, status: affected, version: 0, versionType: semver
lessThanOrEqual: 7.9.0, status: affected, version: 0, versionType: semver
status: unaffected, version: 7.7.3
status: unaffected, version: 7.8.2
status: unaffected, version: 7.9.1
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Mattermost to version v7.7.3, v7.8.2, v7.9.1 or higher.