CVE-2023-47858

描述

Mattermost fails to properly verify the permissions needed for viewing archived public channels,  allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams/<team-id>/channels/deleted endpoint.

受影響套件(7)

• Bitnami/mattermostfrom 0, < 8.1.7, >= 9.0.0, < 9.0.5, >= 9.1.0, < 9.1.4, >= 9.2.0, < 9.2.3
• Go/github.com/mattermost/mattermost-serverfrom 0
• Go/github.com/mattermost/mattermost-server/v5from 0
• Go/github.com/mattermost/mattermost-server/v6from 0, < 7.8.10
• Go/github.com/mattermost/mattermost-server/v6from 0
• Go/github.com/mattermost/mattermost/server/v8from 0
• Go/github.com/mattermost/mattermost/server/v8from 0, < 8.1.1

CVSS 分數

參考連結(4)

• ADVISORYhttps://github.com/advisories/GHSA-w88v-pjr8-cmv2
• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-47858
• PATCHhttps://github.com/mattermost/mattermost
• WEBhttps://mattermost.com/security-updates