CVE-2024-23488

Files of archived channels accessible with the “Allow users to view archived channels” option disabled

CVSS 3.1 LOWEPSS 0.3%CWE-284

Vexday Risk Score

8Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 3.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

29 feb 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Productos afectados

Mattermost · Mattermost

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://mattermost.com/security-updates