CVE-2024-23493— Team associated AD/LDAP Groups Leaked due to missing authorization
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-23493
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Team associated AD/LDAP Groups Leaked due to missing authorization
Source: CVE Program / CVE List V5
Vulnerability Description
Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Mattermost 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mattermost是美国Mattermost公司的一个开源协作平台。 Mattermost存在安全漏洞，该漏洞源于无法正确授权获取与团队相关的AD/LDAP组的请求，从而导致攻击者可以获取其成员的团队的AD/LLDAP组的详细信息。受影响的产品和版本：Mattermost 9.4.2之前的9.4.0版本，9.3.1之前的9.3.0版本，9.2.52之前的9.2.0版本，8.1.9之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mattermost | Mattermost | 0 ~ 9.4.1 | - |
II. Public POCs for CVE-2024-23493
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-23493
请登录查看更多情报信息。
Same Patch Batch · Mattermost · 2024-02-29 · 9 CVEs total
| CVE-2024-1887 | 4.3 MEDIUM | Public channel post content accessible without membership when compliance export is enable |
| CVE-2024-24988 | 4.3 MEDIUM | Excessive resource consumption when sending long emoji names in user custom status |
| CVE-2024-1888 | 4.3 MEDIUM | Existing server guests invited to the team by members without "invite_guest" permission |
| CVE-2024-1942 | 4.3 MEDIUM | Mattermost 安全漏洞 |
| CVE-2024-1953 | 4.3 MEDIUM | Mattermost 安全漏洞 |
| CVE-2024-23488 | 3.1 LOW | Files of archived channels accessible with the “Allow users to view archived channels” opt |
| CVE-2024-1952 | 3.1 LOW | Mattermost 安全漏洞 |
| CVE-2024-1949 | 2.6 LOW | Mattermost 安全漏洞 |
IV. Related Vulnerabilities
Same product: Mattermost
- CVE-2026-7521
SAML certificate deletion allows path traversal to delete ar - CVE-2026-10819
Mattermost Server Denial of Service via Animated GIF Emoji U - CVE-2026-10600
Denial of service via unbounded document content extraction - CVE-2026-8075
Posting a malicious markdown image crashes the Mattermost De - CVE-2026-9602
Mattermost Desktop App crashes when malformed arguments are
Same vendor: Mattermost
- CVE-2026-7521
SAML certificate deletion allows path traversal to delete ar - CVE-2026-10819
Mattermost Server Denial of Service via Animated GIF Emoji U - CVE-2026-10600
Denial of service via unbounded document content extraction - CVE-2026-8075
Posting a malicious markdown image crashes the Mattermost De - CVE-2026-9602
Mattermost Desktop App crashes when malformed arguments are
Same weakness: CWE-200
- CVE-2026-67435
linuxfabrik-lib: fetch() forwards credential headers across - CVE-2026-13697
undici vulnerable to cross-user information disclosure and p - CVE-2026-54660
swagger-typescript-api vulnerable to authorization-token exf - CVE-2026-58157
Apache Traffic Server: Improper server-session reuse can exp - CVE-2026-55403
datamodel-code-generator: Authorization / request headers le
V. Comments for CVE-2024-23493
No comments yet