Information disclosure in Mattermost
CVE-2024-32046
Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored
Vulnerability class: Information Disclosure
EPSS: 0.005 (36.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Mattermost — versions 9.6.0, 9.5.0, 9.4.0
- Mattermost Mattermost_server
Weakness classification (CWE)
Public proof-of-concept exploits
References
- responsibledisclosure@mattermost.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-32046?
- CVE-2024-32046 is a medium-severity vulnerability in Mattermost, classified under Information Disclosure. CVSS score: 4.3/10. Published 2024-04-26.
- How severe is CVE-2024-32046?
- Medium severity. CVSS v3 base score is 4.3 out of 10.
- Is CVE-2024-32046 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.