CVE-2024-10241

Private channel names leaked with Ctrl+K when ElasticSearch is enabled PUBLISHED

Description (CNA)

Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 9.5.0 through 9.5.9; unaffected 9.8.0; unaffected 9.5.10

CWE

CWE-284

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.