CVE-2023-6458: Client side path traversal due to lack of route parameters validation
Mattermost webapp fails to validate route parameters in/<TEAMNAME>/channels/<CHANNELNAME> allowing an attacker to perform a client-side path traversal.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-6458.
What is the severity of CVE-2023-6458?
The severity of CVE-2023-6458 is high with a severity value of 7.1.
What is the description of CVE-2023-6458?
CVE-2023-6458 is a client-side path traversal vulnerability in the Mattermost webapp that allows an attacker to perform a client-side path traversal by exploiting the lack of route parameters validation in /<TEAM_NAME>/channels/<CHANNEL_NAME>.
Which software versions are affected by CVE-2023-6458?
The affected software versions are 9.1.0 and 9.1.2 on GitHub.com/mattermost/mattermost/server/v, 9.0.0 and 9.0.3 on GitHub.com/mattermost/mattermost/server/v8, 8.1.5 on GitHub.com/mattermost/mattermost/server/v8, and 7.8.14 on GitHub.com/mattermost/mattermost-server/v6.
How can I fix CVE-2023-6458?
To fix CVE-2023-6458, update Mattermost to version 9.1.2, 9.0.3, 8.1.5, or 7.8.14, depending on the affected software version.