CVE-2021-37864

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:16

Type Values Removed Values Added
CVSS v2 : 4.0
v3 : 6.5
v2 : 4.0
v3 : 2.6
References () https://mattermost.com/security-updates/ - Vendor Advisory () https://mattermost.com/security-updates/ - Vendor Advisory

Information

Published : 2022-01-18 17:15

Updated : 2024-11-21 06:16


NVD link : CVE-2021-37864

Mitre link : CVE-2021-37864

CVE.ORG link : CVE-2021-37864


JSON object : View

Products Affected

mattermost

  • mattermost
CWE
CWE-284

Improper Access Control

CWE-863

Incorrect Authorization