PT-2024-13635 · Mattermost · Mattermost

Published 2024-01-02 · Updated 2024-06-28 · CVE-2023-48732

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to v8.1.7

Description The issue arises from Mattermost's failure to scope the WebSocket response around notified users to each user separately. As a result, the WebSocket broadcasts information about who was notified about a post to everyone else in the channel. This could potentially lead to unintended information disclosure.

Recommendations For versions prior to v8.1.7, update to version v8.1.7 or later to resolve the issue. As a temporary workaround, consider disabling the use of WebSockets for individual responses in the channel to minimize the risk of information disclosure. Restrict access to sensitive information and channels to minimize the impact of this issue until a patch is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-MATTERMOST-2023-48732

CVE-2023-48732

GHSA-Q7RX-W656-FWMV

GO-2024-2448

Affected Products

Mattermost

References · 14

• https://osv.dev/vulnerability/CVE-2023-48732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48732 · Security Note
• https://osv.dev/vulnerability/GHSA-q7rx-w656-fwmv · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2023-48732 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2448 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/851515be222160bee0a495c0d411056b19ed4111 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48732 · Note
• https://twitter.com/CVEnew/status/1742127813199884397 · Twitter Post
• https://twitter.com/zoomeye_team/status/1742458547030692297 · Twitter Post
• https://github.com/advisories/GHSA-q7rx-w656-fwmv · Note
• https://twitter.com/VulmonFeeds/status/1742158872905666885 · Twitter Post
• https://t.me/cibsecurity/74177 · Telegram Post