Exposure of Sensitive Information to an Unauthorized Actor Affecting github.com/mattermost/mattermost-server/server/v8/channels/app package, versions <7.8.10 >=8.0.0 <8.1.1
Threat Intelligence
EPSS
0.05% (23rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMMATTERMOSTMATTERMOSTSERVERSERVERV8CHANNELSAPP-5931776
- published 5 Oct 2023
- disclosed 2 Oct 2023
- credit aungpyaekoko
Introduced: 2 Oct 2023
CVE-2023-5160 Open this link in a new tabHow to fix?
Upgrade github.com/mattermost/mattermost-server/server/v8/channels/app to version 7.8.10, 8.1.1 or higher.
Overview
Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor through the /api/v4/teams/TEAM_ID/top/team_members endpoint. An attacker can obtain the full name of another user even if the 'Show Full Name' option was disabled by sending a request to the endpoint.
References
CVSS Scores
version 3.1