CVE-2024-1887: Public channel post content accessible without membership when compliance export is enabled
Published Feb 29, 2024
·Updated
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
Affected Software
6 affected componentsFixes available
go/github.com/mattermost/mattermost/server/v8<8.1.9
8.1.9
go/github.com/mattermost/mattermost/server/v8>=9.2.0<9.2.5
9.2.5
go/github.com/mattermost/mattermost/server/v8>=9.3.0<9.3.1
9.3.1
Mattermost Mattermost Server<8.1.9
Mattermost Mattermost Server>=9.2.0<9.2.5
Mattermost Mattermost Server>=9.3.0<9.3.1
Remediation
Information
Update Mattermost Server to versions 9.4,0, 9.3.1, 9.2.5, 8.1.9 or higher.
Event History
Feb 29, 2024
CVE Published
via MITRE·08:05 AM
Data Sourced
via MITRE·08:05 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeakness
Advisory Published
via GitHub·09:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-1887?
CVE-2024-1887 is considered a moderate severity vulnerability.
2
How do I fix CVE-2024-1887?
To fix CVE-2024-1887, upgrade to Mattermost version 8.1.9 or 9.2.5 and above.
3
Who is affected by CVE-2024-1887?
CVE-2024-1887 affects all Mattermost instances that are below version 8.1.9 and between versions 9.2.0 to 9.2.5 and 9.3.0 to 9.3.1.
4
What is the impact of CVE-2024-1887?
CVE-2024-1887 allows unauthorized users to retrieve posts from public channels without proper audit checks.
5
Does CVE-2024-1887 affect private channels?
CVE-2024-1887 only affects public channels and does not impact private channels.