title: Emails of all users are exposed via one of the Boards APIs
description: Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.
problem types: CWE-200 Information Exposure
affected:
{
product: Mattermost Boards
vendor: Mattermost
versions:
lessThanOrEqual: 0.10.0, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: unaffected, version: 0.9.5, versionType: custom
lessThan: unspecified, status: unaffected, version: 0.8.4, versionType: custom
lessThan: unspecified, status: unaffected, version: 0.7.5, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]