CVE-2024-47145CWE-284

Unauthorized access on archived channels via file links

Low · published September 26, 2024

CVSS v3.1
3.1
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.8th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-09-26T08:01Z
EPSS history
Timeline
  • 26 SEP 08:01Z
    Unauthorized access on archived channels via file links
    cvelistv5