High · 8.1 CVE-2023-3615 EUVD-2023-44264GHSA-f56r-hfv8-q98c

Lack of server certificate validation in websockets connection

Published Jul 17, 2023 · Updated Oct 30, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost iOS app Platform: iOS

Description

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection.

Affected products

Vendor	Product	Affected	Fixed
Mattermost	Mattermost iOS app	≤ 2.5.0	2.5.1

References

https://mattermost.com/security-updates