description: Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.
problem types: CWE-284: Improper Access Control
affected:
{
defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 9.2.4, status: affected, version: 9.2.0, versionType: semver
lessThanOrEqual: 8.1.8, status: affected, version: 8.1.0, versionType: semver
status: affected, version: 9.3.0
status: unaffected, version: 9.4
status: unaffected, version: 9.3.1
status: unaffected, version: 9.2.5
status: unaffected, version: 8.1.9
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Mattermost Server to versions 9.4, 9.3.1, 9.2.5, 8.1.9 or higher.