medium4.3
CVE-2024-1942
Mattermost allows attackers access to posts in channels they are not a member of
Impact
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/v8 | >= 9.3.0, < 9.3.1 | 9.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | from 8.1.0 before 8.1.9 from 9.2.0 before 9.2.5 Version 9.3.0 |