CVE-2023-6202: Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards
First published: Mon Nov 27 2023(Updated: )
Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.
Credit: responsibledisclosure@mattermost.com responsibledisclosure@mattermost.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/mattermost/mattermost-server/v6 | <7.8.13 | 7.8.13 |
| go/github.com/mattermost/mattermost/server/v8 | <8.1.4 | 8.1.4 |
| go/github.com/mattermost/mattermost/server/v8 | >=9.0.0<9.0.2 | 9.0.2 |
| go/github.com/mattermost/mattermost/server/v8 | >=9.1.0<9.1.1 | 9.1.1 |
| Mattermost Mattermost | <=7.8.12 | |
| Mattermost Mattermost | >=8.0.0<=8.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-6202?
CVE-2023-6202 is a vulnerability that allows an attacker who is a guest user and knows the ID of another user to get their information via Mattermost Boards.
What is the severity of CVE-2023-6202?
CVE-2023-6202 has a severity of 4.3 (medium).
What software is affected by CVE-2023-6202?
CVE-2023-6202 affects Mattermost server versions 7.8.13, 8.1.4, 9.0.2, and 9.1.1.
How can an attacker exploit CVE-2023-6202?
An attacker who is a guest user and knows the ID of another user can exploit CVE-2023-6202 by accessing their information via Mattermost Boards.
Is there a fix for CVE-2023-6202?
Yes, the fix for CVE-2023-6202 is to update Mattermost server to version 7.8.14, 8.1.5, 9.0.3, or 9.1.2.
- collector/mitre-cve
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory
- alias/GHSA-85jj-c9jr-9jhx
- alias/CVE-2023-6202
- collector/github-advisory-latest
- agent/author
- agent/description
- agent/epss
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- agent/weakness
- collector/epss-latest
- source/FIRST
- vendor/mattermost
- canonical/mattermost mattermost
- version/mattermost mattermost/7.8.12
- version/mattermost mattermost/8.0.0
- version/mattermost mattermost/8.1.3
- package-manager/go