CVE-2023-4105 LOW

CVE-2023-4105: Attachment of deleted message in a thread remains accessible and downloadable

Vendor Mattermost
Product Mattermost
Weakness CWE-862 · Missing authorization
Published August 11, 2023
Last update October 1, 2024
View on NVD All CVEs

CVSS base score

3.1/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message

Key dates

02Disclosure timeline

August 11, 2023 CVE published
October 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-32455 WordPress Fatal Error Notify plugin <= 1.5.2 - Broken Access Control vulnerability CVE-2024-10537 WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration CVE-2023-51507 WordPress Quiz And Survey Master plugin <= 8.1.16 - Broken Access Control vulnerability CVE-2024-3606 ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization CVE-2025-22534 WordPress Slides & Presentations Plugin <= 0.0.39 - Broken Access Control vulnerability