CVE-2021-37864

Users can view the contents of an archived channel when access is explicitly denied by the system admin

CVSS 2.6 LOWEPSS 0.6%CWE-284

Vexday Risk Score

8Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 2.6EPSS 0.6%KEV nãoPoC —Patch —

Lifecycle

18 Jan 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Affected products

Mattermost · Mattermost

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://mattermost.com/security-updates/