Description
Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 9.10.0 – ≤ 9.10.1, 9.9.0 – ≤ 9.9.2, 9.5.0 – ≤ 9.5.8 | 9.11.0 |
Advisories 1
- WID-SEC-2024-1957 Mattermost Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Sep 29, 2024