PT-2023-21384 · Unknown · Mattermost

Juho Nurminen · Published 2023-06-16 · Updated 2023-06-26 · CVE-2023-2787

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost (affected versions not specified)

Description The issue allows an attacker to access arbitrary posts by using the message threads API, as Mattermost fails to check channel membership when accessing message threads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-2787

Affected Products

Mattermost

References · 4

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2787 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2787 · Vendor Advisory
• https://t.me/cvenotify/52477 · Telegram Post