Vulnerability DatabaseCVE-2024-23493

CVE-2024-23493:
vulnerability analysis and mitigation

Overview

CVE-2024-23493 is a security vulnerability discovered in Mattermost that was disclosed on February 29, 2024. The vulnerability stems from improper authorization in the requests fetching team-associated AD/LDAP groups, which allows unauthorized users to access AD/LDAP group details of teams they are not members of (NVD).

Technical details

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, while Mattermost, Inc. assessed it with a score of 4.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) by NIST and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) by Mattermost, Inc (NVD).

Impact

The vulnerability allows unauthorized users to access sensitive information by fetching details of AD/LDAP groups belonging to teams they are not members of, potentially leading to information disclosure (NVD).

Exploitability

The vulnerability affects multiple versions of Mattermost Server including versions up to 8.1.9, versions 9.0.0 to 9.2.5, version 9.3.0 (including RC1 and RC2), and versions 9.4.0 to 9.4.2 (NVD).

Mitigation and workarounds

Users are advised to upgrade to the latest patched versions of Mattermost Server: version 8.1.9 or later for the 8.1.x series, version 9.2.5 or later for the 9.2.x series, and version 9.4.2 or later for the 9.4.x series (NVD).