From 5ebae5cbf956a5a1f2002cd7e15566cbe14909af Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 29 Feb 2024 22:49:36 +0000 Subject: [PATCH] Publish Advisories GHSA-6mx3-9qfh-77gj GHSA-7v3v-984v-h74r GHSA-fx48-xv6q-6gp3 GHSA-hwjf-4667-gqwx GHSA-pfw6-5rx3-xh3c GHSA-xgxj-j98c-59rv GHSA-6mx3-9qfh-77gj GHSA-7v3v-984v-h74r GHSA-fx48-xv6q-6gp3 GHSA-hwjf-4667-gqwx GHSA-pfw6-5rx3-xh3c GHSA-xgxj-j98c-59rv --- .../GHSA-6mx3-9qfh-77gj.json | 99 +++++++++++++++ .../GHSA-7v3v-984v-h74r.json | 118 ++++++++++++++++++ .../GHSA-fx48-xv6q-6gp3.json | 99 +++++++++++++++ .../GHSA-hwjf-4667-gqwx.json | 99 +++++++++++++++ .../GHSA-pfw6-5rx3-xh3c.json | 118 ++++++++++++++++++ .../GHSA-xgxj-j98c-59rv.json | 80 ++++++++++++ .../GHSA-6mx3-9qfh-77gj.json | 38 ------ .../GHSA-7v3v-984v-h74r.json | 38 ------ .../GHSA-fx48-xv6q-6gp3.json | 38 ------ .../GHSA-hwjf-4667-gqwx.json | 38 ------ .../GHSA-pfw6-5rx3-xh3c.json | 38 ------ .../GHSA-xgxj-j98c-59rv.json | 38 ------ 12 files changed, 613 insertions(+), 228 deletions(-) create mode 100644 advisories/github-reviewed/2024/02/GHSA-6mx3-9qfh-77gj/GHSA-6mx3-9qfh-77gj.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-7v3v-984v-h74r/GHSA-7v3v-984v-h74r.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-fx48-xv6q-6gp3/GHSA-fx48-xv6q-6gp3.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-hwjf-4667-gqwx/GHSA-hwjf-4667-gqwx.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-pfw6-5rx3-xh3c/GHSA-pfw6-5rx3-xh3c.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-xgxj-j98c-59rv/GHSA-xgxj-j98c-59rv.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-6mx3-9qfh-77gj/GHSA-6mx3-9qfh-77gj.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-7v3v-984v-h74r/GHSA-7v3v-984v-h74r.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-fx48-xv6q-6gp3/GHSA-fx48-xv6q-6gp3.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-hwjf-4667-gqwx/GHSA-hwjf-4667-gqwx.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-pfw6-5rx3-xh3c/GHSA-pfw6-5rx3-xh3c.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-xgxj-j98c-59rv/GHSA-xgxj-j98c-59rv.json diff --git a/advisories/github-reviewed/2024/02/GHSA-6mx3-9qfh-77gj/GHSA-6mx3-9qfh-77gj.json b/advisories/github-reviewed/2024/02/GHSA-6mx3-9qfh-77gj/GHSA-6mx3-9qfh-77gj.json new file mode 100644 index 00000000000..70e504083f4 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-6mx3-9qfh-77gj/GHSA-6mx3-9qfh-77gj.json @@ -0,0 +1,99 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6mx3-9qfh-77gj", + "modified": "2024-02-29T22:48:31Z", + "published": "2024-02-29T09:30:34Z", + "aliases": [ + "CVE-2024-24988" + ], + "summary": "Mattermost denial of service through long emoji value", + "details": "Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.3.0" + }, + { + "fixed": "9.3.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.2.0" + }, + { + "fixed": "9.2.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24988" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T22:48:30Z", + "nvd_published_at": "2024-02-29T08:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-7v3v-984v-h74r/GHSA-7v3v-984v-h74r.json b/advisories/github-reviewed/2024/02/GHSA-7v3v-984v-h74r/GHSA-7v3v-984v-h74r.json new file mode 100644 index 00000000000..9ed19b53246 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-7v3v-984v-h74r/GHSA-7v3v-984v-h74r.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7v3v-984v-h74r", + "modified": "2024-02-29T22:48:24Z", + "published": "2024-02-29T09:30:34Z", + "aliases": [ + "CVE-2024-23493" + ], + "summary": "Mattermost leaks details of AD/LDAP groups of a teams", + "details": "Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of. \n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.4.0" + }, + { + "fixed": "9.4.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.3.0" + }, + { + "fixed": "9.3.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.2.0" + }, + { + "fixed": "9.2.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23493" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T22:48:24Z", + "nvd_published_at": "2024-02-29T08:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-fx48-xv6q-6gp3/GHSA-fx48-xv6q-6gp3.json b/advisories/github-reviewed/2024/02/GHSA-fx48-xv6q-6gp3/GHSA-fx48-xv6q-6gp3.json new file mode 100644 index 00000000000..9649b2db85b --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-fx48-xv6q-6gp3/GHSA-fx48-xv6q-6gp3.json @@ -0,0 +1,99 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fx48-xv6q-6gp3", + "modified": "2024-02-29T22:48:18Z", + "published": "2024-02-29T09:30:34Z", + "aliases": [ + "CVE-2024-1887" + ], + "summary": "Mattermost post fetching without auditing in compliance export ", + "details": "Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export. \n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.3.0" + }, + { + "fixed": "9.3.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.2.0" + }, + { + "fixed": "9.2.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1887" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T22:48:17Z", + "nvd_published_at": "2024-02-29T08:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-hwjf-4667-gqwx/GHSA-hwjf-4667-gqwx.json b/advisories/github-reviewed/2024/02/GHSA-hwjf-4667-gqwx/GHSA-hwjf-4667-gqwx.json new file mode 100644 index 00000000000..f166c4c449c --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-hwjf-4667-gqwx/GHSA-hwjf-4667-gqwx.json @@ -0,0 +1,99 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hwjf-4667-gqwx", + "modified": "2024-02-29T22:48:42Z", + "published": "2024-02-29T12:31:06Z", + "aliases": [ + "CVE-2024-1942" + ], + "summary": "Mattermost allows attackers access to posts in channels they are not a member of", + "details": "Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.3.0" + }, + { + "fixed": "9.3.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.2.0" + }, + { + "fixed": "9.2.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1942" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T22:48:42Z", + "nvd_published_at": "2024-02-29T11:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-pfw6-5rx3-xh3c/GHSA-pfw6-5rx3-xh3c.json b/advisories/github-reviewed/2024/02/GHSA-pfw6-5rx3-xh3c/GHSA-pfw6-5rx3-xh3c.json new file mode 100644 index 00000000000..047b4237215 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-pfw6-5rx3-xh3c/GHSA-pfw6-5rx3-xh3c.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pfw6-5rx3-xh3c", + "modified": "2024-02-29T22:48:37Z", + "published": "2024-02-29T09:30:34Z", + "aliases": [ + "CVE-2024-1888" + ], + "summary": "Mattermost fails to check the \"invite_guest\" permission ", + "details": "Mattermost fails to check the \"invite_guest\" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.4.0" + }, + { + "fixed": "9.4.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.3.0" + }, + { + "fixed": "9.3.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.2.0" + }, + { + "fixed": "9.2.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1888" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T22:48:37Z", + "nvd_published_at": "2024-02-29T09:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-xgxj-j98c-59rv/GHSA-xgxj-j98c-59rv.json b/advisories/github-reviewed/2024/02/GHSA-xgxj-j98c-59rv/GHSA-xgxj-j98c-59rv.json new file mode 100644 index 00000000000..86e526cb2bc --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-xgxj-j98c-59rv/GHSA-xgxj-j98c-59rv.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xgxj-j98c-59rv", + "modified": "2024-02-29T22:48:21Z", + "published": "2024-02-29T09:30:34Z", + "aliases": [ + "CVE-2024-23488" + ], + "summary": "Mattermost fails to properly restrict the access of files attached to posts", + "details": "Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.4.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23488" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T22:48:21Z", + "nvd_published_at": "2024-02-29T08:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-6mx3-9qfh-77gj/GHSA-6mx3-9qfh-77gj.json b/advisories/unreviewed/2024/02/GHSA-6mx3-9qfh-77gj/GHSA-6mx3-9qfh-77gj.json deleted file mode 100644 index 8f3cea18b01..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-6mx3-9qfh-77gj/GHSA-6mx3-9qfh-77gj.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6mx3-9qfh-77gj", - "modified": "2024-02-29T09:30:34Z", - "published": "2024-02-29T09:30:34Z", - "aliases": [ - "CVE-2024-24988" - ], - "details": "Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24988" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-400" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T08:15:47Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-7v3v-984v-h74r/GHSA-7v3v-984v-h74r.json b/advisories/unreviewed/2024/02/GHSA-7v3v-984v-h74r/GHSA-7v3v-984v-h74r.json deleted file mode 100644 index 2d57ea74dc9..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-7v3v-984v-h74r/GHSA-7v3v-984v-h74r.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-7v3v-984v-h74r", - "modified": "2024-02-29T09:30:34Z", - "published": "2024-02-29T09:30:34Z", - "aliases": [ - "CVE-2024-23493" - ], - "details": "Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of. \n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23493" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T08:15:47Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-fx48-xv6q-6gp3/GHSA-fx48-xv6q-6gp3.json b/advisories/unreviewed/2024/02/GHSA-fx48-xv6q-6gp3/GHSA-fx48-xv6q-6gp3.json deleted file mode 100644 index 2b7270e228b..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-fx48-xv6q-6gp3/GHSA-fx48-xv6q-6gp3.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fx48-xv6q-6gp3", - "modified": "2024-02-29T09:30:34Z", - "published": "2024-02-29T09:30:34Z", - "aliases": [ - "CVE-2024-1887" - ], - "details": "Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export. \n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1887" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T08:15:46Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-hwjf-4667-gqwx/GHSA-hwjf-4667-gqwx.json b/advisories/unreviewed/2024/02/GHSA-hwjf-4667-gqwx/GHSA-hwjf-4667-gqwx.json deleted file mode 100644 index 795f367850a..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-hwjf-4667-gqwx/GHSA-hwjf-4667-gqwx.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hwjf-4667-gqwx", - "modified": "2024-02-29T12:31:06Z", - "published": "2024-02-29T12:31:06Z", - "aliases": [ - "CVE-2024-1942" - ], - "details": "Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1942" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T11:15:07Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-pfw6-5rx3-xh3c/GHSA-pfw6-5rx3-xh3c.json b/advisories/unreviewed/2024/02/GHSA-pfw6-5rx3-xh3c/GHSA-pfw6-5rx3-xh3c.json deleted file mode 100644 index 0dee88b0720..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-pfw6-5rx3-xh3c/GHSA-pfw6-5rx3-xh3c.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-pfw6-5rx3-xh3c", - "modified": "2024-02-29T09:30:34Z", - "published": "2024-02-29T09:30:34Z", - "aliases": [ - "CVE-2024-1888" - ], - "details": "Mattermost fails to check the \"invite_guest\" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1888" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T09:15:06Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-xgxj-j98c-59rv/GHSA-xgxj-j98c-59rv.json b/advisories/unreviewed/2024/02/GHSA-xgxj-j98c-59rv/GHSA-xgxj-j98c-59rv.json deleted file mode 100644 index 23bb66db421..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-xgxj-j98c-59rv/GHSA-xgxj-j98c-59rv.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xgxj-j98c-59rv", - "modified": "2024-02-29T09:30:34Z", - "published": "2024-02-29T09:30:34Z", - "aliases": [ - "CVE-2024-23488" - ], - "details": "Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23488" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T08:15:47Z" - } -} \ No newline at end of file