CVE-2024-23488

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-23488

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23488.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-23488

Aliases

Related

CGA-6vx5-5gq4-gxqw

Published

2024-02-29T08:15:47.110Z

Modified

2026-02-05T12:18:50.349044Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.

References

https://mattermost.com/security-updates

Affected packages

Git / github.com/mattermost/mattermost-server

Affected ranges

Type: GIT
Repo: https://github.com/mattermost/mattermost-server
Events: Fixed

4c83724516242843802cc75840b08ead6afbd37b

Introduced

987e843629fe3f11861fda23ceb66884f5973ef1

Fixed

f344590398e35c6373957fb3b4f761b9acfd82b2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23488.json"