title: Client side path traversal due to lack of route parameters validation
description: Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.
problem types: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
affected:
{
defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 9.1.1, status: affected, version: 0, versionType: semver
lessThanOrEqual: 9.0.2, status: affected, version: 0, versionType: semver
lessThanOrEqual: 8.1.4, status: affected, version: 0, versionType: semver
lessThanOrEqual: 7.8.13, status: affected, version: 0, versionType: semver
status: unaffected, version: 9.1.2
status: unaffected, version: 9.0.3
status: unaffected, version: 8.1.5
status: unaffected, version: 7.8.14
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Mattermost Server to versions 9.1.2, 9.0.3, 8.1.5, 7.8.14 or higher.