Vulnerability in Mattermost allows access to archived channels

CVE-2024-42406

5.4MEDIUM

Key Information

Vendor: Mattermost
Status: Mattermost
Vendor: CVE Published:; 26 September 2024

Summary

Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files.

Affected Version(s)

Mattermost = 9.11.0

Mattermost <= 9.10.1

Mattermost <= 9.9.2

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Sep 26, 2024
Vulnerability Reserved.
Sep 23, 2024

Collectors

NVD DatabaseMitre Database

Credit

Daniel Espino Garcia