CVE-2023-43754
Assigner: Mattermost
Published: 2023-11-27T09:11:13.283Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions: lessThanOrEqual: 7.8.12
status: affected
version: 0
versionType: semver
lessThanOrEqual: 8.1.3
status: affected
version: 0
versionType: semver
lessThanOrEqual: 9.0.1
status: affected
version: 0
versionType: semver
lessThanOrEqual: 9.1.0
status: affected
version: 0
versionType: semver
status: unaffected
version: 9.0.2
status: unaffected
version: 9.1.1
status: unaffected
version: 7.8.13
status: unaffected
version: 8.1.4
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Harrison Healey
descriptions: supportingMedia: base64: no
type: text/html
value: <p>Mattermost fails to check whether the&nbsp; “Allow users to view archived channels”&nbsp; setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the&nbsp;“Allow users to view archived channels” setting is disabled.&nbsp;</p>
value: Mattermost fails to check whether the  “Allow users to view archived channels”  setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled. 


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: <p>Update Mattermost Server to versions 9.0.2, 9.1.1, 7.8.13, 8.1.4 or higher.</p>
value: Update Mattermost Server to versions 9.0.2, 9.1.1, 7.8.13, 8.1.4 or higher.


source: advisory: MMSA-2023-00241
defect: https://mattermost.atlassian.net/browse/MM-54221
discovery: INTERNAL
title: Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels
x_generator: engine: Vulnogram 0.1.0-dev