CVE-2024-32046:
vulnerability analysis and mitigation

Overview

Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 contain a vulnerability where detailed error messages in API requests are not removed even when developer mode is disabled. This vulnerability was assigned CVE-2024-32046 and was disclosed in April 2024 (Mattermost Security).

Technical details

The vulnerability is classified as an information disclosure issue (CWE-200) that exposes sensitive information to unauthorized actors. It received a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. The vulnerability stems from a failure to properly remove detailed error messages in API responses when developer mode is disabled (NVD Database).

Impact

When exploited, this vulnerability allows attackers to obtain sensitive information about the server, including the full paths where files are stored. This information disclosure could potentially aid attackers in planning more targeted attacks against the affected Mattermost installations (NVD Database).

Exploitability

The vulnerability requires low attack complexity and low privileges to exploit, but does require network access to the target system. No user interaction is needed for exploitation (NVD Database).

Mitigation and workarounds

Users should upgrade to the latest version of Mattermost that contains the fix for this vulnerability. The fixed versions are: 9.6.1 for 9.6.x users, 9.5.3 for 9.5.x users, 9.4.5 for 9.4.x users, and 8.1.12 for 8.1.x users (Mattermost Security).