Mattermost's detailed error messages reveal the full file path
Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-32046US | medium4.3 | — | ||
Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off whic… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/mattermost/mattermostPACKAGE
- https://github.com/mattermost/mattermost/commit/2a48b5b3428cae494452125401e4f72780543ac8WEB
- https://github.com/mattermost/mattermost/commit/93738756ff79777c6e340c8de63a7b4b0f881d27WEB
- https://github.com/mattermost/mattermost/commit/aa222c66b799c12e32eeb8eae6f555bf6140375bWEB
- https://github.com/mattermost/mattermost/commit/c84c25b20c8b8726a2f126ae9370a72498096172WEB
- https://mattermost.com/security-updatesWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-32046ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan