CVE-2023-6202: Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards
Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.
Other sources
Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-6202?
CVE-2023-6202 is a vulnerability that allows an attacker who is a guest user and knows the ID of another user to get their information via Mattermost Boards.
What is the severity of CVE-2023-6202?
CVE-2023-6202 has a severity of 4.3 (medium).
What software is affected by CVE-2023-6202?
CVE-2023-6202 affects Mattermost server versions 7.8.13, 8.1.4, 9.0.2, and 9.1.1.
How can an attacker exploit CVE-2023-6202?
An attacker who is a guest user and knows the ID of another user can exploit CVE-2023-6202 by accessing their information via Mattermost Boards.
Is there a fix for CVE-2023-6202?
Yes, the fix for CVE-2023-6202 is to update Mattermost server to version 7.8.14, 8.1.5, 9.0.3, or 9.1.2.