CVE-2024-52032

Description

Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled.

Reserved 2024-11-05 | Published 2024-11-09 | Updated 2024-11-12 | Assigner Mattermost

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status
unaffected

10.0.0
affected

9.11.0
affected

10.1.0
unaffected

10.0.1
unaffected

9.11.3
unaffected

Credits

Adrian (thiefmaster) finder

References

mattermost.com/security-updates

cve.org (CVE-2024-52032)

nvd.nist.gov (CVE-2024-52032)

Download JSON