CVE-2024-23488: Files of archived channels accessible with the “Allow users to view archived channels” option disabled
Published Feb 29, 2024
·Updated
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.
Affected Software
4 affected componentsFixes available
go/github.com/mattermost/mattermost/server/v8<8.1.9
8.1.9
go/github.com/mattermost/mattermost/server/v8>=9.0.0<9.4.2
9.4.2
Mattermost Mattermost Server<8.1.9
Mattermost Mattermost Server>=9.0.0<9.4.2
Remediation
Information
Update Mattermost Server to versions 9.5.0, 9.4.2, 8.1.9 or higher.
Event History
Feb 29, 2024
CVE Published
via MITRE·08:03 AM
Data Sourced
via MITRE·08:03 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeakness
Advisory Published
via GitHub·09:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-23488?
CVE-2024-23488 has a moderate severity due to improper access restrictions to files in archived channels.
2
How do I fix CVE-2024-23488?
To fix CVE-2024-23488, update Mattermost to version 8.1.9 or 9.4.2.
3
Which versions of Mattermost are affected by CVE-2024-23488?
CVE-2024-23488 affects Mattermost versions prior to 8.1.9 and versions between 9.0.0 and 9.4.2.
4
What does CVE-2024-23488 exploit?
CVE-2024-23488 exploits the lack of proper access control for files attached to posts in archived channels.
5
Can users access archived channel files if allowed?
Yes, users can access files in archived channels even if the option to view archived channels is disabled.