Mattermost post fetching without auditing in compliance export
Moderate severity
GitHub Reviewed
Published
Feb 29, 2024
to the GitHub Advisory Database
•
Updated Aug 7, 2024
Package
Affected versions
>= 9.3.0, < 9.3.1
>= 9.2.0, < 9.2.5
< 8.1.9
Patched versions
9.3.1
9.2.5
8.1.9
Description
Published by the National Vulnerability Database
Feb 29, 2024
Published to the GitHub Advisory Database
Feb 29, 2024
Reviewed
Feb 29, 2024
Last updated
Aug 7, 2024
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
References