PT-2024-2072 · Mattermost · Mattermost

Vultza · Published 2024-02-29 · Updated 2025-01-11 · CVE-2024-23493

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to v8.1.9

Description The issue is related to a lack of proper authorization in requests fetching team-associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team they are not a member of. This can be exploited by a remote attacker to gain unauthorized access to user information. The vulnerable endpoint is related to the /plugins/playbooks/api/v0/telemetry/run/ component.

Recommendations For Mattermost versions prior to v8.1.9, update to version v8.1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable /plugins/playbooks/api/v0/telemetry/run/ endpoint until a patch is available. Avoid using this endpoint to fetch team-associated AD/LDAP groups until the issue is resolved.

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

BDU:2024-01966

BIT-MATTERMOST-2024-23493

CVE-2024-23493

GHSA-7V3V-984V-H74R

GO-2024-2590

Affected Products

Mattermost

References · 13

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23493 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23493 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2024-23493 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7v3v-984v-h74r · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2590 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01966 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://twitter.com/CVEnew/status/1763116399898026304 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23493 · Note
• https://t.me/cvenotify/72668 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1763165008559566867 · Twitter Post
• https://github.com/advisories/GHSA-7v3v-984v-h74r · Note