CVE-2024-23488

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-23488
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23488.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-23488
Aliases
Related
Published
2024-02-29T08:15:47.110Z
Modified
2026-04-10T05:09:30.797193Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.

References

Affected packages

Git / github.com/mattermost/mattermost-server

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4c83724516242843802cc75840b08ead6afbd37b
Introduced
987e843629fe3f11861fda23ceb66884f5973ef1
Fixed
f344590398e35c6373957fb3b4f761b9acfd82b2
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.1.9"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.4.2"
        }
    ]
}

Affected versions

@mattermost/client@8.*
@mattermost/client@8.1.1
@mattermost/client@9.*
@mattermost/client@9.4.0
@mattermost/types@8.*
@mattermost/types@8.1.1
@mattermost/types@9.*
@mattermost/types@9.4.0
Other
cloud-2022-07-20-1
cloud-2022-08-10-1
cloud-2022-09-08-1
cloud-2022-10-06-1
cloud-2022-11-11-1
cloud-2022-11-24-1
cloud-2023-07-26-1
server/public/v0.*
server/public/v0.0.10
server/public/v0.0.11
server/public/v0.0.5
server/public/v0.0.6
server/public/v0.0.7
server/public/v0.0.8
server/public/v0.0.9
v0.*
v0.5.0
v4.*
v4.10.0-rc1
v4.2.0-rc1
v4.3.0-rc1
v4.4.0-rc1
v4.5.0-rc1
v4.6.0-rc1
v4.6.0-rc2
v4.7.0-rc1
v4.8.0-rc1
v4.9.0-rc1
v5.*
v5.0.0-rc1
v5.1.0-rc1
v5.2.0-rc1
v5.2.0-rc2
v8.*
v8.1.0
v8.1.0-rc2
v8.1.1
v8.1.1-rc1
v8.1.1-rc2
v8.1.2
v8.1.2-rc1
v8.1.2-rc2
v8.1.3
v8.1.3-rc1
v8.1.3-rc2
v8.1.4
v8.1.4-rc1
v8.1.4-rc2
v8.1.5
v8.1.5-rc1
v8.1.5-rc2
v8.1.6
v8.1.6-rc1
v8.1.7
v8.1.7-rc1
v8.1.7-rc2
v8.1.7-rc3
v8.1.8
v8.1.8-rc1
v8.1.8-rc2
v8.1.9-rc1
v8.1.9-rc2
v9.*
v9.4.0
v9.4.0-rc1
v9.4.0-rc2
v9.4.0-rc3
v9.4.0-rc4
v9.4.1
v9.4.2-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23488.json"