GHSA-3gpx-p63p-pr5r
Mattermost Fails to Enforce Certain Search APIs
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.4.0, < 10.4.3 | 10.4.3 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.3.0, < 10.3.4 | 10.3.4 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.11.0, < 9.11.9 | 9.11.9 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.5.0, < 10.5.1 | 10.5.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.
References
External links from the advisory. They lead to third-party sites.