CVE-2023-43754: Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels
First published: Mon Nov 27 2023(Updated: )
Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled.
Credit: responsibledisclosure@mattermost.com responsibledisclosure@mattermost.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/mattermost/mattermost-server/v6 | <7.8.13 | 7.8.13 |
| go/github.com/mattermost/mattermost/server/v8 | <8.1.4 | 8.1.4 |
| go/github.com/mattermost/mattermost/server/v8 | >=9.0.0<9.0.2 | 9.0.2 |
| go/github.com/mattermost/mattermost/server/v8 | >=9.1.0<9.1.1 | 9.1.1 |
| Mattermost Mattermost | <=7.8.12 | |
| Mattermost Mattermost | >=8.0.0<=8.1.3 | |
| Mattermost Mattermost | >=9.0.0<=9.0.1 | |
| Mattermost Mattermost | =9.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2023-43754.
What is the severity level of the CVE-2023-43754 vulnerability?
The severity level of the CVE-2023-43754 vulnerability is medium with a severity value of 4.3.
How does Mattermost fail to check the 'Allow users to view archived channels' setting?
Mattermost fails to check whether the 'Allow users to view archived channels' setting is enabled during permalink previews display.
Can members view permalink previews of archived channels even if the 'Allow users to view archived channels' setting is disabled?
Yes, members can view permalink previews of archived channels even if the 'Allow users to view archived channels' setting is disabled.
What versions of Mattermost are affected by the CVE-2023-43754 vulnerability?
Mattermost versions 7.8.13, 8.1.4, 9.0.0 to 9.0.2, and 9.1.0 to 9.1.1 are affected by the CVE-2023-43754 vulnerability.
Where can I find more information about this security issue?
You can find more information about this security issue at the following references: [Mattermost Security Updates](https://mattermost.com/security-updates), [NVD - CVE-2023-43754](https://nvd.nist.gov/vuln/detail/CVE-2023-43754), [GitHub Advisory GHSA-jjr7-372r-cx7x](https://github.com/advisories/GHSA-jjr7-372r-cx7x).
What Common Weakness Enumeration (CWE) category does the CVE-2023-43754 vulnerability belong to?
The CVE-2023-43754 vulnerability belongs to CWE category 200.
- collector/mitre-cve
- collector/github-advisory-latest
- alias/GHSA-jjr7-372r-cx7x
- alias/CVE-2023-43754
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory
- agent/author
- package-manager/go
- vendor/mattermost
- canonical/mattermost mattermost
- version/mattermost mattermost/7.8.12
- version/mattermost mattermost/8.0.0
- version/mattermost mattermost/8.1.3
- version/mattermost mattermost/9.0.0
- version/mattermost mattermost/9.0.1
- version/mattermost mattermost/9.1.0