CVE-2024-1952

Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control the ephemeral post update to access individual posts' contents in channels they are not a member of...

GHSA-XGXJ-J98C-59RV Mattermost fails to properly restrict the access of files attached to posts

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled...

GHSA-FX48-XV6Q-6GP3 Mattermost post fetching without auditing in compliance export

Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export...

CVE-2024-23488

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled...

CVE-2024-1887

Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export...

Code injection

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled...

Design/Logic Flaw

Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export...

CVE-2024-1887 Public channel post content accessible without membership when compliance export is enabled

Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export...

CVE-2024-1887

Mattermost CVE-2024-1887 affects the Mattermost server where compliance export checks are not performed for public-channel posts, allowing a user who is not a channel member to fetch posts without audit in the compliance export. The related OSV advisory GO-2024-2591 ties this to Mattermost server...

CVE-2024-23488

Mattermost CVE-2024-23488 concerns a file-access control bug in archived channels. Connected advisory GO-2024-2595 describes a vulnerability in github.com/mattermost/mattermost/server/v8 prior to v8.1.9 where attachments in posts could be accessed despite channel archives settings. Affected compo...

CVE-2024-23488 Files of archived channels accessible with the “Allow users to view archived channels” option disabled

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled...

PT-2024-2030 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions prior to v8.1.9 Description: The issue is related to inadequate access control in Mattermost, allowing remote attackers to gain unauthorized access to files in archived channels. Specifically, members can access files...

PT-2024-18394 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions prior to 8.1.9 Description: Mattermost fails to check if compliance export is enabled when fetching posts of public channels, allowing a user that is not a member of the public channel to fetch the posts, which will not be...

PT-2024-18446 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.8 Description: The issue allows an authenticated attacker who can control the update of an ephemeral post to access individual posts' contents in channels they are not a member of. This is due to a failur...

Stable Channel Update for Desktop

The Stable channel has been updated to 122.0.6261.94 for Mac,Linux and 122.0.6261.94/.95 to Windows which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. The Extended Stable channel has been updated to 122.0.6261.94 for Mac and 122.0.6261.95...

Mozilla: Out-of-bounds memory read in networking channels

The Mozilla Foundation Security Advisory describes this flaw as: When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read...

Mozilla: Out-of-bounds memory read in networking channels

The Mozilla Foundation Security Advisory describes this flaw as: When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read...

Mozilla: Out-of-bounds memory read in networking channels

The Mozilla Foundation Security Advisory describes this flaw as: When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read...

Mozilla: Out-of-bounds memory read in networking channels

The Mozilla Foundation Security Advisory describes this flaw as: When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read...

Mozilla: Out-of-bounds memory read in networking channels

The Mozilla Foundation Security Advisory describes this flaw as: When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read...