GitHub Advisoryadvisory · Go

GHSA-hwjf-4667-gqwx Mattermost allows attackers access to posts in channels they are not a member of

MEDIUM Published 2024-02-29 Modified 2024-07-08 Official page ↗
Aliases
CVE-2024-1942
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-284
Reviewed
2024-02-29

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 9.3.0, < 9.3.1 → fixed in 9.3.1 • Go github.com/mattermost/mattermost/server/v8: >= 9.2.0, < 9.2.5 → fixed in 9.2.5 • Go github.com/mattermost/mattermost/server/v8: < 8.1.9 → fixed in 8.1.9

Description

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.

Related

Alias · CVE (1)

  • CVE-2024-1942 Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References