Skip to content
OpenAdvisories
High · 7.1 CVE-2023-6458 BIT-mattermost-2023-6458EUVD-2023-3139GHSA-7664-hcp7-f497

Client side path traversal due to lack of route parameters validation

Published Dec 6, 2023 · Updated Aug 2, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 9.1.1, ≤ 9.0.2, ≤ 8.1.4, ≤ 7.8.13 9.1.2

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server/v6 < 7.8.14 7.8.14 GHSA-7664-hcp7-f497
Go github.com/mattermost/mattermost/server >= 9.1.0, < 9.1.2 9.1.2 GHSA-7664-hcp7-f497
Go github.com/mattermost/mattermost/server/v8 < 8.1.5 8.1.5 GHSA-7664-hcp7-f497
Go github.com/mattermost/mattermost/server/v8 >= 9.0.0, < 9.0.3 9.0.3 GHSA-7664-hcp7-f497

References