Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
vulnrichmentMattermostVULNRICHMENT:CVE-2024-23488
HistoryFeb 29, 2024 - 8:03 a.m.

CVE-2024-23488 Files of archived channels accessible with the “Allow users to view archived channels” option disabled

2024-02-2908:03:20
CWE-284
Mattermost
github.com
mattermost
access restriction
archived channels
security issue

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

JSON

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.

Related

veracode 1
osv 4
prion 1
cve 1
nvd 1
cvelist 1
github 1
nessus 1
veracode
veracode
Improper Access Control
2024-03-01 12:22:29
osv
osv
CGA-j7pv-pc6j-2hjq
2024-07-15 22:00:54
Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server
2024-06-28 15:28:53
Mattermost fails to properly restrict the access of files attached to posts
2024-02-29 09:30:34
prion
prion
Code injection
2024-02-29 08:15:00
cve
cve
CVE-2024-23488
2024-02-29 08:15:47
nvd
nvd
CVE-2024-23488
2024-02-29 08:15:47
cvelist
cvelist
CVE-2024-23488 Files of archived channels accessible with the “Allow users to view archived channels” option disabled
2024-02-29 08:03:20
github
github
Mattermost fails to properly restrict the access of files attached to posts
2024-02-29 09:30:34
nessus
nessus
Mattermost Server < 8.1.9 / 9.2.x < 9.2.5 / 9.3.x < 9.3.1 / 9.4.x < 9.4.2, 9.5.0 Multiple Vulnerabilities (MMSA-2023-00285)
2024-03-07 00:00:00

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

JSON
Related for VULNRICHMENT:CVE-2024-23488
veracode1osv4prion1cve1nvd1cvelist1github1nessus1