CVE-2024-39807 LOW

CVE-2024-39807: Channel IDs of archived/restored channels leaked via webhook events

Vendor Mattermost
Product Mattermost
Weakness CWE-200 · Info exposure
Published July 3, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

3.1/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to retrieve the channel IDs of archived or restored channels.

Key dates

02Disclosure timeline

July 3, 2024 CVE published
August 2, 2024 Record updated