Sensitive Information Disclosure in Mattermost Server by Mattermost
CVE-2016-11078

6.5MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost Server
Vendor
CVE Published:
19 June 2020

What is CVE-2016-11078?

A vulnerability exists in Mattermost Server versions prior to 3.0.0 that may enable unauthorized users to access confidential information, specifically credential fields located in the config.json file. This flaw can be exploited through the System Console UI, presenting a risk of sensitive data exposure which could lead to further compromises. It is crucial for users to upgrade to the latest version to mitigate this security risk and protect their sensitive information.

References

https://mattermost.com/security-updates/
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.