CVE-2024-47145

Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*

History

26 Sep 2024, 18:42

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~3.1~~	v2 : unknown v3 : 4.3
First Time		Mattermost Mattermost mattermost Server
CWE		NVD-CWE-noinfo
References	~~() https://mattermost.com/security-updates -~~	() https://mattermost.com/security-updates - Vendor Advisory
CPE		cpe:2.3:a:mattermost:mattermost_server::::::::

26 Sep 2024, 13:32

Type	Values Removed	Values Added
Summary		(es) Las versiones 9.5.x <= 9.5.8 de Mattermost no autorizan correctamente el acceso a los canales archivados cuando la visualización de canales archivados está deshabilitada, lo que permite a un atacante ver publicaciones y archivos de canales archivados a través de enlaces de archivos.

26 Sep 2024, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-26 08:15

Updated : 2024-09-26 18:42

NVD link : CVE-2024-47145

Mitre link : CVE-2024-47145

CVE.ORG link : CVE-2024-47145

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

NVD-CWE-noinfo CWE-284

Improper Access Control

{"id": "CVE-2024-47145", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "published": "2024-09-26T08:15:06.403", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows\u00a0an attacker to view posts and files of archived channels via file links."}, {"lang": "es", "value": "Las versiones 9.5.x <= 9.5.8 de Mattermost no autorizan correctamente el acceso a los canales archivados cuando la visualizaci\u00f3n de canales archivados est\u00e1 deshabilitada, lo que permite a un atacante ver publicaciones y archivos de canales archivados a trav\u00e9s de enlaces de archivos."}], "lastModified": "2024-09-26T18:42:33.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC97EDD1-AD9D-484B-99B0-D49541EFBA52", "versionEndExcluding": "9.5.9", "versionStartIncluding": "9.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}