← CVE Intelligence

CVE-2023-6202

Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards PUBLISHED

Description (CNA)

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.

Affected (CNA)

Vendor / productVersions
Mattermost / Mattermostaffected 0 through 7.8.12; affected 0 through 8.1.3; affected 0 through 9.0.1; affected 0 through 9.1.0; unaffected 9.0.2; unaffected 9.1.1; unaffected 7.8.13; unaffected 8.1.4

CWE

CWE-284

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.