GHSA-7ggc-5r84-xf54

Suggest an improvement
Source
https://github.com/advisories/GHSA-7ggc-5r84-xf54
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-7ggc-5r84-xf54/GHSA-7ggc-5r84-xf54.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7ggc-5r84-xf54
Aliases
Published
2022-07-15T00:00:16Z
Modified
2024-08-21T15:26:47.133854Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Mattermost users could access some sensitive information via API call
Details

Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed": true,
    "severity": "MODERATE",
    "github_reviewed_at": "2022-07-21T22:35:35Z",
    "nvd_published_at": "2022-07-14T18:15:00Z"
}
References

Affected packages

Go

github.com/mattermost/mattermost-server/v6

Package

Name
github.com/mattermost/mattermost-server/v6
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server/v6

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.3.9

github.com/mattermost/mattermost-server/v6

Package

Name
github.com/mattermost/mattermost-server/v6
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server/v6

Affected ranges

Type
SEMVER
Events
Introduced
6.4.0
Fixed
6.5.2

github.com/mattermost/mattermost-server/v6

Package

Name
github.com/mattermost/mattermost-server/v6
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server/v6

Affected ranges

Type
SEMVER
Events
Introduced
6.6.0
Fixed
6.6.2

github.com/mattermost/mattermost-server/v6

Package

Name
github.com/mattermost/mattermost-server/v6
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server/v6

Affected ranges

Type
SEMVER
Events
Introduced
6.7.0
Fixed
6.7.1

Affected versions

6.*

6.7.0