Headline
GHSA-762g-9p7f-mrww: Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-46872
Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery
Moderate severity GitHub Reviewed Published Oct 29, 2024 to the GitHub Advisory Database • Updated Oct 29, 2024
Package
gomod github.com/mattermost/mattermost/server/v8 (Go)
Affected versions
< 8.0.0-20240926115259-20ed58906adc
Patched versions
8.0.0-20240926115259-20ed58906adc
Published to the GitHub Advisory Database
Oct 29, 2024
Last updated
Oct 29, 2024