Mattermost Server is vulnerable to Path Traversal when files are stored locally
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-18876US | medium4.9 | — | ||
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/mattermost/mattermostPACKAGE
- https://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086WEB
- https://github.com/mattermost/mattermost/commit/6d3cb2ce07fc799832081e93843b405b390057faWEB
- https://github.com/mattermost/mattermost/commit/fadd9514f6e71590aba781a7035e1de4150137b0WEB
- https://mattermost.com/security-updatesWEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-18876ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan