CVE-2024-23488CWE-284

Files of archived channels accessible with the “Allow users to view archived channels” option disabled

Low · published February 29, 2024

CVSS v3.1
3.1
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00314 · 23.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-02-29T08:03Z
EPSS history
Timeline
  • 29 FEB 08:03Z
    Files of archived channels accessible with the “Allow users to view archived channels” option disabled
    cvelistv5