CVE-2023-47858: Mattermost Viewing Archived Public Channels Permissions Vulnerability
Summary
CVE-2023-47858: Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- mattermost · Bitnami
- github.com/mattermost/mattermost-server/v6 · Go
The same CVE-2023-47858 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mattermost is an open-source messaging platform that provides team collaboration and communication features. It is written in Go and is widely used for internal communication within organizations. The mattermost-server package, along with its v5, v6, and v8 versions, is responsible for handling the server-side functionality of Mattermost. This vulnerability affects all versions of the package.
Vulnerability Detail
The vulnerability allows unauthorized users to view archived public channels in Mattermost. This could lead to the exposure of sensitive information and compromise the privacy and security of the communication within the organization. The issue arises due to improper permissions checks when accessing archived public channels. Attackers can exploit this vulnerability by bypassing the intended access restrictions and gaining unauthorized access to archived public channels.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually revoke access to archived public channels for unauthorized users. This can be done by adjusting the channel permissions settings within the Mattermost administration panel. By removing the 'View' permission for unauthorized users, the risk of exploitation can be reduced. However, this workaround is not recommended as it does not address the root cause of the vulnerability and may introduce other access control issues.
Conclusion
The Mattermost viewing archived public channels permissions vulnerability allows unauthorized users to access sensitive information. It is crucial for users to update to the latest version of the mattermost-server package to mitigate this vulnerability. Additionally, proper access control configurations should be maintained to ensure the security and privacy of communication within Mattermost.
See every vulnerability recorded for github.com/mattermost/mattermost-server →
FAQ
Mattermost is an open-source messaging platform used for team collaboration and communication within organizations.
The mattermost-server package is responsible for handling the server-side functionality of Mattermost. It is written in Go and is widely used in Mattermost deployments.
The vulnerability allows unauthorized users to view archived public channels in Mattermost, potentially exposing sensitive information and compromising communication privacy and security.
To fix this vulnerability, users should update the mattermost-server package to the latest version that includes the patch for this issue.
A temporary workaround is to manually revoke access to archived public channels for unauthorized users by adjusting the channel permissions settings within the Mattermost administration panel.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mattermost/mattermost-server.
