CVE-2023-45316 (published 2023-12-12T08:23:17.299Z)
Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack.


Affected products: Vendor: Mattermost
Product: Mattermost
Versions: 0, 0, 0, 0, 0, 8.1.6, 9.0.4, 9.1.3, 9.2.2, 7.8.15