CVE-2024-23493: Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that…

PriorityP433medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EPSS

0.39%

31.6th percentile

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-server	>= 9.2.0+incompatible < 9.2.5+incompatible	9.2.5+incompatible
github.com	mattermost_mattermost-server	>= 9.3.0+incompatible < 9.3.1+incompatible	9.3.1+incompatible
github.com	mattermost_mattermost-server	>= 9.4.0+incompatible < 9.4.2+incompatible	9.4.2+incompatible
github.com	mattermost_mattermost_server_v8	>= 9.2.0 < 9.2.5	9.2.5
github.com	mattermost_mattermost_server_v8	>= 9.3.0 < 9.3.1	9.3.1
github.com	mattermost_mattermost_server_v8	>= 9.4.0 < 9.4.2	9.4.2
mattermost	mattermost	<= 9.4.1	—
mattermost	mattermost_server	< 8.1.9	8.1.9
mattermost	mattermost_server	—	—
mattermost	mattermost_server	>= 9.0.0 < 9.2.5	9.2.5
mattermost	mattermost_server	>= 9.4.0 < 9.4.2	9.4.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.