~ / search / GHSA-7664-hcp7-f497

GHSA-7664-hcp7-f497

Mattermost Injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-6458

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-server/v6 < 7.8.14 7.8.14
Go github.com/mattermost/mattermost/server/v8 < 8.1.5 8.1.5
Go github.com/mattermost/mattermost/server/v8 >= 9.0.0, < 9.0.3 9.0.3
Go github.com/mattermost/mattermost/server >= 9.1.0, < 9.1.2 9.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.

References

External links from the advisory. They lead to third-party sites.