Reflected client side path traversal leading to CSRF in Playbooks

CVE-2023-45316

What is CVE-2023-45316?

The Mattermost platform contains a vulnerability in its telemetry API where it improperly validates the input for telemetry run IDs. This flaw allows an attacker to conduct path traversal, enabling them to manipulate the API endpoint and potentially initiate a cross-site request forgery (CSRF) attack. Users are advised to update to the latest version to mitigate the risks associated with this issue.

References