CVE-2023-48732

2024-01-0210:15:08

Google

osv.dev

mattermost

websocket

notified users

broadcasting

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.7%

JSON

Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.

CPENameOperatorVersion
mattermosteq4.5.2
mattermosteq4.8.0-rc5
mattermosteqserver/public/v0.0.5
mattermosteq5.3.1
mattermosteq3.7.0
mattermosteq8.1.2-rc2
mattermosteq4.6.0-rc3
mattermosteq4.6.0-rc5
mattermosteq4.7.0-rc4
mattermosteq3.0.3

Name	Operator	Version
mattermost	eq	4.5.2
mattermost	eq	4.8.0-rc5
mattermost	eq	server/public/v0.0.5
mattermost	eq	5.3.1
mattermost	eq	3.7.0
mattermost	eq	8.1.2-rc2
mattermost	eq	4.6.0-rc3
mattermost	eq	4.6.0-rc5
mattermost	eq	4.7.0-rc4
mattermost	eq	3.0.3