CVE-2023-47858

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-47858", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2023-12-21T08:00:43.436Z", "datePublished": "2024-01-02T09:54:25.057Z", "dateUpdated": "2025-06-17T20:29:05.638Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "9.2.2", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "9.1.3", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "9.0.4", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "8.1.6", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "8.1.7"}, {"status": "unaffected", "version": "9.0.5"}, {"status": "unaffected", "version": "9.1.4"}, {"status": "unaffected", "version": "9.2.3"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "vultza (vultza)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost fails to properly verify the permissions needed for viewing archived public channels,&nbsp;&nbsp;allowing a member of one team to get details about the archived public channels of another team via the&nbsp;GET /api/v4/teams/&lt;team-id&gt;/channels/deleted endpoint.</p>"}], "value": "Mattermost fails to properly verify the permissions needed for viewing archived public channels,\u00a0\u00a0allowing a member of one team to get details about the archived public channels of another team via the\u00a0GET /api/v4/teams/<team-id>/channels/deleted endpoint.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-01-02T09:54:25.057Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost Server to versions 8.1.7, 9.0.5, 9.1.4, 9.2.3 or higher.</p>"}], "value": "Update Mattermost Server to versions 8.1.7, 9.0.5, 9.1.4, 9.2.3 or higher.\n\n"}], "source": {"advisory": "MMSA-2023-00269", "defect": ["https://mattermost.atlassian.net/browse/MM-55005"], "discovery": "EXTERNAL"}, "title": "Details of archived public channels are leaked to members of another team", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:16:43.686Z"}, "title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-47858", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-06T16:29:43.414429Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T20:29:05.638Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:16:43.686Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-47858", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-06T16:29:43.414429Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T20:23:41.605Z"}}], "cna": {"title": "Details of archived public channels are leaked to members of another team", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-55005"], "advisory": "MMSA-2023-00269", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "vultza (vultza)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.2.2"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.1.3"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.0.4"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.1.6"}, {"status": "unaffected", "version": "8.1.7"}, {"status": "unaffected", "version": "9.0.5"}, {"status": "unaffected", "version": "9.1.4"}, {"status": "unaffected", "version": "9.2.3"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost Server to versions 8.1.7, 9.0.5, 9.1.4, 9.2.3 or higher.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost Server to versions 8.1.7, 9.0.5, 9.1.4, 9.2.3 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Mattermost fails to properly verify the permissions needed for viewing archived public channels,\u00a0\u00a0allowing a member of one team to get details about the archived public channels of another team via the\u00a0GET /api/v4/teams/<team-id>/channels/deleted endpoint.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost fails to properly verify the permissions needed for viewing archived public channels,&nbsp;&nbsp;allowing a member of one team to get details about the archived public channels of another team via the&nbsp;GET /api/v4/teams/&lt;team-id&gt;/channels/deleted endpoint.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-01-02T09:54:25.057Z"}}}, "cveMetadata": {"cveId": "CVE-2023-47858", "state": "PUBLISHED", "dateUpdated": "2025-06-17T20:29:05.638Z", "dateReserved": "2023-12-21T08:00:43.436Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2024-01-02T09:54:25.057Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "9.2.2", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "9.1.3", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "9.0.4", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "8.1.6", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "8.1.7"}, {"status": "unaffected", "version": "9.0.5"}, {"status": "unaffected", "version": "9.1.4"}, {"status": "unaffected", "version": "9.2.3"}]}], "source": "responsibledisclosure@mattermost.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FFBD373-195D-4481-B87D-5B329DBEC33D", "versionEndExcluding": "8.1.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "707E5CDF-AD8D-4D91-8DE8-B32E6E06003B", "versionEndExcluding": "9.0.5", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "689E6CCF-B722-4C95-AAB6-010CC285CF80", "versionEndExcluding": "9.1.4", "versionStartIncluding": "9.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "51A35D8A-9E04-4450-B27E-401B9D43CC12", "versionEndExcluding": "9.2.3", "versionStartIncluding": "9.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost fails to properly verify the permissions needed for viewing archived public channels,\u00a0\u00a0allowing a member of one team to get details about the archived public channels of another team via the\u00a0GET /api/v4/teams/<team-id>/channels/deleted endpoint.\n\n"}, {"lang": "es", "value": "Mattermost no verifica adecuadamente los permisos necesarios para ver los canales p\u00fablicos archivados, lo que permite que un miembro de un equipo obtenga detalles sobre los canales p\u00fablicos archivados de otro equipo a trav\u00e9s de GET /api/v4/teams//channels/deleted endpoint."}], "id": "CVE-2023-47858", "lastModified": "2026-06-17T06:33:25.600", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-47858", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-02-06T16:29:43.414429Z", "version": "2.0.3"}}]}, "published": "2024-01-02T10:15:08.117", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}