CVE-2023-48732: Exposure of Sensitive Information to an Unauthorized Actor

January 2, 2024 (updated January 3, 2024)

Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.

References

github.com/advisories/GHSA-q7rx-w656-fwmv
github.com/mattermost/mattermost/commit/851515be222160bee0a495c0d411056b19ed4111
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2023-48732

Code Behaviors & Features

Detect and mitigate CVE-2023-48732 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →