CVE-2024-23488
published 2024-02-29CVE-2024-23488: Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.31%
23.7th percentile
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 9.0.0+incompatible < 9.4.2+incompatible | 9.4.2+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.1.9 | 8.1.9 |
| github.com | mattermost_mattermost_server_v8 | >= 9.0.0 < 9.4.2 | 9.4.2 |
| mattermost | mattermost | <= 8.1.8 | — |
| mattermost | mattermost_server | < 8.1.9 | 8.1.9 |
| mattermost | mattermost_server | >= 9.0.0 < 9.4.2 | 9.4.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server
osv·2024-06-28
CVE-2024-23488 Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server
Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server
Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.
GHSA
Mattermost fails to properly restrict the access of files attached to posts
ghsa·2024-02-29
CVE-2024-23488 [LOW] CWE-284 Mattermost fails to properly restrict the access of files attached to posts
Mattermost fails to properly restrict the access of files attached to posts
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.
OSV
Mattermost fails to properly restrict the access of files attached to posts
osv·2024-02-29
CVE-2024-23488 [LOW] Mattermost fails to properly restrict the access of files attached to posts
Mattermost fails to properly restrict the access of files attached to posts
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-29
Published