← CVE Intelligence

CVE-2024-32046

Detailed error discloses full file path with dev mode off PUBLISHED

Description (CNA)

Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored

Affected (CNA)

Vendor / productVersions
Mattermost / Mattermostaffected 9.6.0; affected 9.5.0 through 9.5.2; affected 9.4.0 through 9.4.4; affected 8.1.0 through 8.1.11; unaffected 9.7.0; unaffected 9.6.1; unaffected 9.5.3; unaffected 9.4.5; unaffected 8.1.12

CWE

CWE-200

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.