CVE-2024-32939CWE-284

Email addresses of remote users visible in props regardless of server settings

Medium · published August 22, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-08-22T06:29Z
EPSS history
Timeline
  • 22 AUG 06:29Z
    Email addresses of remote users visible in props regardless of server settings
    cvelistv5