CVE-2023-48732

published 2024-01-02

CVE-2023-48732: Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about…

medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-server	>= 0 < 8.1.7+incompatible	8.1.7+incompatible
github.com	mattermost_mattermost-server_v6	>= 0 < 8.1.7	8.1.7
github.com	mattermost_mattermost_server_v8	>= 0 < 8.1.7	8.1.7
mattermost	mattermost	<= 8.1.6	—
mattermost	mattermost_server	< 8.1.7	8.1.7

CWE-200