CVE-2024-1887
published 2024-02-29CVE-2024-1887: Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.33%
25.6th percentile
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 9.2.0+incompatible < 9.2.5+incompatible | 9.2.5+incompatible |
| github.com | mattermost_mattermost-server | >= 9.3.0+incompatible < 9.3.1+incompatible | 9.3.1+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.1.9 | 8.1.9 |
| github.com | mattermost_mattermost_server_v8 | >= 9.2.0 < 9.2.5 | 9.2.5 |
| github.com | mattermost_mattermost_server_v8 | >= 9.3.0 < 9.3.1 | 9.3.1 |
| mattermost | mattermost | <= 8.1.8 | — |
| mattermost | mattermost_server | < 8.1.9 | 8.1.9 |
| mattermost | mattermost_server | >= 9.2.0 < 9.2.5 | 9.2.5 |
| mattermost | mattermost_server | >= 9.3.0 < 9.3.1 | 9.3.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server
osv·2024-06-28
CVE-2024-1887 Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server
Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server
Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.
OSV
Mattermost post fetching without auditing in compliance export
osv·2024-02-29
CVE-2024-1887 [HIGH] Mattermost post fetching without auditing in compliance export
Mattermost post fetching without auditing in compliance export
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
GHSA
Mattermost post fetching without auditing in compliance export
ghsa·2024-02-29
CVE-2024-1887 [HIGH] CWE-284 Mattermost post fetching without auditing in compliance export
Mattermost post fetching without auditing in compliance export
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-29
Published