description: A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.
problem types: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 8.1.8, status: affected, version: 8.1.0, versionType: semver
lessThanOrEqual: 9.4.1, status: affected, version: 9.4.0, versionType: semver
status: unaffected, version: 9.5
status: unaffected, version: 9.4.2
status: unaffected, version: 8.1.9
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.6
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Mattermost Server to versions 9.5 ( 2024), 9.4.2, 8.1.9 or higher.