Mattermost vulnerability allows for one-click client-side path traversal and CSRF

CVE-2024-40886

Summary

The vulnerability in Mattermost is attributed to inadequate sanitization of user inputs in the frontend, specifically used for redirection processes. This oversight potentially exposes the User Management page in the system console to a one-click client-side path traversal, facilitating a Cross-Site Request Forgery (CSRF) attack. Organizations using vulnerable versions should prioritize updates and apply security patches to safeguard their systems against exploitation.

References