Exposure of Sensitive Information to an Unauthorized Actor Affecting github.com/mattermost/mattermost-server package, versions <8.1.9>=9.0.0 <9.2.5>=9.3.0 <9.3.1>=9.4.0 <9.4.2


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.04% (11th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-GOLANG-GITHUBCOMMATTERMOSTMATTERMOSTSERVER-6351497
  • published1 Mar 2024
  • disclosed29 Feb 2024
  • creditvultza

Introduced: 29 Feb 2024

CVE-2024-23493  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

Upgrade github.com/mattermost/mattermost-server to version 8.1.9, 9.2.5, 9.3.1, 9.4.2 or higher.

Overview

github.com/mattermost/mattermost-server is an open source Slack-alternative in Golang and React.

Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor due to improper authorization checks on requests fetching team associated AD/LDAP groups. An attacker can fetch details of AD/LDAP groups of a team that they are not a member of by sending crafted requests.

CVSS Scores

version 3.1