~ / search / GHSA-vx97-8q8q-qgq5

GHSA-vx97-8q8q-qgq5

Mattermost's detailed error messages reveal the full file path

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-32046

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-server >= 8.1.0, < 8.1.12 8.1.12
Go github.com/mattermost/mattermost-server >= 9.5.0, < 9.5.3 9.5.3
Go github.com/mattermost/mattermost-server >= 9.6.0-rc1, < 9.6.1 9.6.1
Go github.com/mattermost/mattermost-server >= 9.4.0, < 9.4.5 9.4.5

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored

References

External links from the advisory. They lead to third-party sites.