CVE-2024-47145: Unauthorized access on archived channels via file links
Published Sep 26, 2024
·Updated
Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.
Affected Software
1 affected component
Mattermost Mattermost Server>=9.5.0<9.5.9
Remediation
Information
Update Mattermost to versions 9.11.0, 9.5.9 or higher.
Event History
Sep 26, 2024
CVE Published
via MITRE·08:01 AM
Data Sourced
via MITRE·08:01 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-47145?
CVE-2024-47145 has a medium severity level due to unauthorized access to archived channels.
2
How do I fix CVE-2024-47145?
To fix CVE-2024-47145, upgrade Mattermost to version 9.5.9 or later.
3
What are the potential impacts of CVE-2024-47145?
CVE-2024-47145 can allow attackers to view sensitive posts and files from archived channels, compromising confidential information.
4
What versions of Mattermost are affected by CVE-2024-47145?
Mattermost versions 9.5.0 through 9.5.8 are affected by CVE-2024-47145.
5
Is there a workaround for CVE-2024-47145?
There is no official workaround for CVE-2024-47145; upgrading to the patched version is recommended.