GitHub Advisoryadvisory · Go

GHSA-7664-hcp7-f497 Mattermost Injection vulnerability

HIGH Published 2023-12-06 Modified 2023-12-12 Official page ↗
Aliases
CVE-2023-6458
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost/server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weaknesses
CWE-22, CWE-74
Reviewed
2023-12-08

Affected packages

• Go github.com/mattermost/mattermost-server/v6: < 7.8.14 → fixed in 7.8.14 • Go github.com/mattermost/mattermost/server/v8: < 8.1.5 → fixed in 8.1.5 • Go github.com/mattermost/mattermost/server/v8: >= 9.0.0, < 9.0.3 → fixed in 9.0.3 • Go github.com/mattermost/mattermost/server: >= 9.1.0, < 9.1.2 → fixed in 9.1.2

Description

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal.

Related

Alias · CVE (1)

  • CVE-2023-6458 Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References