PT-2024-16133

CVE-2024-10241

Published

2024-10-29

Updated

2024-11-05

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.5.x through 9.5.9

Description The issue arises when ElasticSearch is enabled, and Mattermost fails to properly filter channel data. This allows a user to obtain private channel names by using the cmd+K/ctrl+K shortcut.

Recommendations For Mattermost versions 9.5.x through 9.5.9, update to the latest version to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to ElasticSearch or disabling the feature until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Juho Nurminen

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers

CVE-2024-10241