CVE-2023-48732
published 2024-01-02CVE-2023-48732: Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about…
PriorityP419medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.46%
37.4th percentile
Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 0 < 8.1.7+incompatible | 8.1.7+incompatible |
| github.com | mattermost_mattermost-server_v6 | >= 0 < 8.1.7 | 8.1.7 |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.1.7 | 8.1.7 |
| mattermost | mattermost | <= 8.1.6 | — |
| mattermost | mattermost_server | < 8.1.7 | 8.1.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server
osv·2024-06-28
CVE-2023-48732 Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server
Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server
Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.7.
GHSA
Mattermost notified all users in the channel when using WebSockets to respond individually
ghsa·2024-01-02
CVE-2023-48732 [MEDIUM] CWE-200 Mattermost notified all users in the channel when using WebSockets to respond individually
Mattermost notified all users in the channel when using WebSockets to respond individually
Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.
OSV
Mattermost notified all users in the channel when using WebSockets to respond individually
osv·2024-01-02
CVE-2023-48732 [MEDIUM] Mattermost notified all users in the channel when using WebSockets to respond individually
Mattermost notified all users in the channel when using WebSockets to respond individually
Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-01-02
Published