CVE-2023-6459

Name of the Vulnerable Software and Affected Versions Mattermost (affected versions not specified)

Description The issue concerns the /metrics endpoint, which is grouping calls by id and reporting this id in the response. Since this id corresponds to the channelID, the public /metrics endpoint is inadvertently revealing channelIDs.

Recommendations As a temporary workaround, consider restricting access to the /metrics endpoint to minimize the risk of information disclosure. Avoid using the public /metrics endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.