VULNERABILITY INTELLIGENCE

CVE-2024-32046

CVSS score4.3 MEDIUM
EPSS probability0.45%
CISA KEVNot currently listed
Published2024-04-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Description

Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-200
  • nvd@nist.gov: CWE-209

Primary references