| Assigner | Mattermost |
| Reserved | 2024-07-01 |
| Published | 2024-07-03 |
| Updated | 2024-07-03 |
Description
Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to retrieve the channel IDs of archived or restored channels.
| CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Problem types
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Product status
9.8.0
9.5.0
9.9.0
9.8.1
9.5.6
Credits
Harrison Healey
References
https://mattermost.com/security-updates
