Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2023-4105

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message

VectorNETWORK

PublishedAug 11, 2023, 07:15

Published Byresponsibledisclosure@mattermost.com

Base Score

Score4.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/mattermost/mattermost-server/v6(Go)7.9.07.9.6N/A

github.com/mattermost/mattermost-server/v6(Go)7.10.07.10.4N/A

github.com/mattermost/mattermost-server/v6(Go)07.8.8N/A

References

https://mattermost.com/security-updates

Weakness Type

CWE-862

CVSS Metrics

Base Score

4.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK