CVE-2023-43754: Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

Q: What is the vulnerability ID for this security issue?

The vulnerability ID for this security issue is CVE-2023-43754.

Q: What is the severity level of the CVE-2023-43754 vulnerability?

The severity level of the CVE-2023-43754 vulnerability is medium with a severity value of 4.3.

Q: How does Mattermost fail to check the 'Allow users to view archived channels' setting?

Mattermost fails to check whether the 'Allow users to view archived channels' setting is enabled during permalink previews display.

Q: Can members view permalink previews of archived channels even if the 'Allow users to view archived channels' setting is disabled?

Yes, members can view permalink previews of archived channels even if the 'Allow users to view archived channels' setting is disabled.

Q: What versions of Mattermost are affected by the CVE-2023-43754 vulnerability?

Mattermost versions 7.8.13, 8.1.4, 9.0.0 to 9.0.2, and 9.1.0 to 9.1.1 are affected by the CVE-2023-43754 vulnerability.

Q: Where can I find more information about this security issue?

You can find more information about this security issue at the following references: [Mattermost Security Updates](https://mattermost.com/security-updates), [NVD - CVE-2023-43754](https://nvd.nist.gov/vuln/detail/CVE-2023-43754), [GitHub Advisory GHSA-jjr7-372r-cx7x](https://github.com/advisories/GHSA-jjr7-372r-cx7x).

Q: What Common Weakness Enumeration (CWE) category does the CVE-2023-43754 vulnerability belong to?

The CVE-2023-43754 vulnerability belongs to CWE category 200.

Published Nov 27, 2023

Updated

Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled.

Other sources

Mattermost fails to check whether the "Allow users to view archived channels" setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the "Allow users to view archived channels" setting is disabled.

Affected Software

8 affected componentsFixes available

go/github.com/mattermost/mattermost-server/v6<7.8.13

7.8.13

go/github.com/mattermost/mattermost/server/v8<8.1.4

8.1.4

go/github.com/mattermost/mattermost/server/v8>=9.0.0<9.0.2

9.0.2

go/github.com/mattermost/mattermost/server/v8>=9.1.0<9.1.1

9.1.1

Mattermost Mattermost<=7.8.12

Mattermost Mattermost>=8.0.0<=8.1.3

Mattermost Mattermost>=9.0.0<=9.0.1

Mattermost Mattermost=9.1.0

Remediation

Information

Update Mattermost Server to versions 9.0.2, 9.1.1, 7.8.13, 8.1.4 or higher.

Event History

Nov 27, 2023

CVE Published

09:11 AM

Data Sourced

09:11 AM

RemedyDescriptionSeverityWeakness

Advisory Published

12:30 PM

Frequently Asked Questions

What is the vulnerability ID for this security issue?