CVE-2023-6459 — Public endpoint /metrics of Calls plugin reveals channel IDs

CVE-2023-6459

Public endpoint /metrics of Calls plugin reveals channel IDs PUBLISHED

Description (CNA)

Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 7.8.13; affected 0 through 8.1.4; unaffected 8.1.5; unaffected 7.8.14

CWE

CWE-200

References

https://mattermost.com/security-updates

ADP enrichment

CVE

No English description supplied.

https://mattermost.com/security-updates

CISA-ADP

No English description supplied.

No references supplied.