MEDIUM 4.3 Go
Mattermost notified all users in the channel when using WebSockets to respond individually
GHSA-q7rx-w656-fwmv · BIT-mattermost-2023-48732 · CVE-2023-48732 · GO-2024-2448
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-48732
- WEB https://github.com/mattermost/mattermost/commit/851515be222160bee0a495c0d411056b19ed4111
- ADVISORY https://github.com/advisories/GHSA-q7rx-w656-fwmv
- PACKAGE https://github.com/mattermost/mattermost
- WEB https://mattermost.com/security-updates
Ready to move
Start Securing
Free, no credit card | First findings in minutes