CVE-2024-23493 - Vulnerability Details - OpenCVE

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mattermost	Mattermost Server

Configuration 1 [-]

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server:9.3.0:-::::::
	cpe:2.3:a:mattermost:mattermost_server:9.3.0:rc1::::::
	cpe:2.3:a:mattermost:mattermost_server:9.3.0:rc2::::::

No data.

References

Link	Providers
https://mattermost.com/security-updates

History

Fri, 10 Jan 2025 16:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mattermost Mattermost mattermost Server
Weaknesses		CWE-862
CPEs		cpe:2.3:a:mattermost:mattermost_server:::::::: cpe:2.3:a:mattermost:mattermost_server:9.3.0:-:::::: cpe:2.3:a:mattermost:mattermost_server:9.3.0:rc1:::::: cpe:2.3:a:mattermost:mattermost_server:9.3.0:rc2::::::
Vendors & Products		Mattermost Mattermost mattermost Server

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2024-02-29T08:02:32.128Z

Updated: 2024-08-01T23:06:24.717Z

Reserved: 2024-02-26T08:14:42.964Z

Link: CVE-2024-23493

Vulnrichment

Updated: 2024-08-01T23:06:24.717Z

NVD

Status : Analyzed

Published: 2024-02-29T08:15:47.380

Modified: 2025-01-10T15:34:43.287

Link: CVE-2024-23493

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23493", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2024-02-26T08:14:42.964Z", "datePublished": "2024-02-29T08:02:32.128Z", "dateUpdated": "2024-08-01T23:06:24.717Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "9.4.1", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "9.3.0", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "9.2.5", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "8.1.8", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "9.5.0"}, {"status": "unaffected", "version": "9.4.2"}, {"status": "unaffected", "version": "9.3.1"}, {"status": "unaffected", "version": "9.2.5"}, {"status": "unaffected", "version": "8.1.9"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "vultza (vultza)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of. </p>"}], "value": "Mattermost fails to properly authorize the requests fetching\u00a0team associated AD/LDAP groups, allowing a user to fetch details of\u00a0AD/LDAP groups of a team that they are not a member of.\u00a0\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-02-29T08:02:32.128Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost Server to versions 9.5.0, 9.4.2, 9.3.1, 9.2.5, 8.1.9 or higher.</p>"}], "value": "Update Mattermost Server to versions 9.5.0, 9.4.2, 9.3.1, 9.2.5, 8.1.9 or higher.\n\n"}], "source": {"advisory": "MMSA-2023-00284", "defect": ["https://mattermost.atlassian.net/browse/MM-55216"], "discovery": "EXTERNAL"}, "title": " Team associated AD/LDAP Groups Leaked due to missing authorization", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-06T16:06:51.577325Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:45:38.797Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:24.717Z"}, "title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:24.717Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-06T16:06:51.577325Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:12.803Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": " Team associated AD/LDAP Groups Leaked due to missing authorization", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-55216"], "advisory": "MMSA-2023-00284", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "vultza (vultza)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.4.1"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.3.0"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.2.5"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.1.8"}, {"status": "unaffected", "version": "9.5.0"}, {"status": "unaffected", "version": "9.4.2"}, {"status": "unaffected", "version": "9.3.1"}, {"status": "unaffected", "version": "9.2.5"}, {"status": "unaffected", "version": "8.1.9"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost Server to versions 9.5.0, 9.4.2, 9.3.1, 9.2.5, 8.1.9 or higher.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost Server to versions 9.5.0, 9.4.2, 9.3.1, 9.2.5, 8.1.9 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Mattermost fails to properly authorize the requests fetching\u00a0team associated AD/LDAP groups, allowing a user to fetch details of\u00a0AD/LDAP groups of a team that they are not a member of.\u00a0\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of. </p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-02-29T08:02:32.128Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23493", "state": "PUBLISHED", "dateUpdated": "2024-08-01T23:06:24.717Z", "dateReserved": "2024-02-26T08:14:42.964Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2024-02-29T08:02:32.128Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEF3AB70-F893-4C93-B1A6-C6B82F2C1816", "versionEndExcluding": "8.1.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "068FD4E8-B93A-42CE-8F90-F81D66F7FB89", "versionEndExcluding": "9.2.5", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B3CC387-1591-408A-A136-9B5B4C921223", "versionEndExcluding": "9.4.2", "versionStartIncluding": "9.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:9.3.0:-:*:*:*:*:*:*", "matchCriteriaId": "8F679A96-8EB0-4D6B-81A0-48A7CB5E955F", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:9.3.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "8532CAD6-E40C-4D3B-8323-3F20DB433B7E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:9.3.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "680A0F36-FDCB-4BFC-A853-B23DF4605DF3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost fails to properly authorize the requests fetching\u00a0team associated AD/LDAP groups, allowing a user to fetch details of\u00a0AD/LDAP groups of a team that they are not a member of.\u00a0\n\n"}, {"lang": "es", "value": "Mattermost no autoriza adecuadamente las solicitudes que buscan grupos AD/LDAP asociados al equipo, lo que permite a un usuario obtener detalles de los grupos AD/LDAP de un equipo del que no es miembro."}], "id": "CVE-2024-23493", "lastModified": "2025-01-10T15:34:43.287", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-29T08:15:47.380", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}