CVE-2024-23488 - OpenCVE

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://mattermost.com/security-updates

History

No history.

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2024-02-29T08:03:20.744Z

Updated: 2024-08-01T23:06:24.721Z

Reserved: 2024-02-26T08:14:42.978Z

Link: CVE-2024-23488

Vulnrichment

Updated: 2024-08-01T23:06:24.721Z

NVD

Status : Awaiting Analysis

Published: 2024-02-29T08:15:47.110

Modified: 2024-02-29T13:49:29.390

Link: CVE-2024-23488

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23488", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2024-02-26T08:14:42.978Z", "datePublished": "2024-02-29T08:03:20.744Z", "dateUpdated": "2024-08-01T23:06:24.721Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "8.1.8", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "9.4.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "9.5.0"}, {"status": "unaffected", "version": "9.4.2"}, {"status": "unaffected", "version": "8.1.9"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "BhaRat (hackit_bharat)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the \u201cAllow users to view archived channels\u201d option is disabled.</p>"}], "value": "Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the \u201cAllow users to view archived channels\u201d option is disabled.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-02-29T08:04:33.155Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost Server to versions 9.5.0, 9.4.2, 8.1.9 or higher.</p>"}], "value": "Update Mattermost Server to versions 9.5.0, 9.4.2, 8.1.9 or higher.\n\n"}], "source": {"advisory": "MMSA-2023-00292", "defect": ["https://mattermost.atlassian.net/browse/MM-56173"], "discovery": "EXTERNAL"}, "title": "Files of archived channels accessible with the \u201cAllow users to view archived channels\u201d option disabled", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23488", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-01T16:30:02.570622Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:45:42.951Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:24.721Z"}, "title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:24.721Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23488", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-01T16:30:02.570622Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:14.503Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Files of archived channels accessible with the \u201cAllow users to view archived channels\u201d option disabled", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-56173"], "advisory": "MMSA-2023-00292", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "BhaRat (hackit_bharat)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.1.8"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.4.1"}, {"status": "unaffected", "version": "9.5.0"}, {"status": "unaffected", "version": "9.4.2"}, {"status": "unaffected", "version": "8.1.9"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost Server to versions 9.5.0, 9.4.2, 8.1.9 or higher.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost Server to versions 9.5.0, 9.4.2, 8.1.9 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the \u201cAllow users to view archived channels\u201d option is disabled.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the \u201cAllow users to view archived channels\u201d option is disabled.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-02-29T08:04:33.155Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23488", "state": "PUBLISHED", "dateUpdated": "2024-08-01T23:06:24.721Z", "dateReserved": "2024-02-26T08:14:42.978Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2024-02-29T08:03:20.744Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}