PT-2024-2030 · Mattermost · Mattermost

Bharat · Published 2024-02-29 · Updated 2025-05-12 · CVE-2024-23488

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to v8.1.9

Description The issue is related to inadequate access control in Mattermost, allowing remote attackers to gain unauthorized access to files in archived channels. Specifically, members can access files attached to posts in archived channels even when the "Allow users to view archived channels" option is disabled.

Recommendations For versions prior to v8.1.9, update to version v8.1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to archived channels and their attached files until the update is applied.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-01906

CVE-2024-23488

GHSA-XGXJ-J98C-59RV

GO-2024-2595

Affected Products

Mattermost

References · 13

• https://mattermost.com/security-updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01906 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-23488 · Security Note
• https://osv.dev/vulnerability/GHSA-xgxj-j98c-59rv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23488 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2595 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23488 · Note
• https://twitter.com/CVEnew/status/1763116398857933019 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1763165261589311720 · Twitter Post
• https://t.me/cvenotify/72667 · Telegram Post
• https://t.me/cvenotify/121739 · Telegram Post
• https://github.com/advisories/GHSA-xgxj-j98c-59rv · Note