GitHub Advisoryadvisory · Go

GHSA-6mvp-gh77-7vwh Mattermost Server allows user to get private channel names

MEDIUM Published 2024-10-29 Modified 2024-10-29 Official page ↗
Aliases
CVE-2024-10241
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-284
Reviewed
2024-10-29

Affected packages

• Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20240813135334-8f3a13122f55 → fixed in 8.0.0-20240813135334-8f3a13122f55

Description

Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K.

Related

Alias · CVE (1)

  • CVE-2024-10241 Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References