CVE-2023-5160: Full name disclosure via team top membership with Show Full Name option disabled
Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAMID/top/teammembers endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this Mattermost issue?
The vulnerability ID for this Mattermost issue is CVE-2023-5160.
What is the severity of CVE-2023-5160?
The severity of CVE-2023-5160 is medium with a severity value of 4.3.
How does Mattermost fail to check the Show Full Name option in this vulnerability?
Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint, allowing a member to get the full name of another user even if the Show Full Name option was disabled.
Which versions of Mattermost are affected by this vulnerability?
Versions 7.0.0 to 7.8.10 and versions 8.0.0 to 8.1.1 of Mattermost are affected by this vulnerability.
How can I fix CVE-2023-5160?
To fix CVE-2023-5160, you should update your Mattermost installation to a version that is not affected by this vulnerability.