UpHeron
All vulnerabilities

Servers and applications

CVE-2024-32046

Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored

Severity
Medium 4.3
Published
26 Apr 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.1.12, 9.4.5, 9.5.3, 9.6.1
Sources
NVD

Affected software

SoftwareAffected versions
MattermostServers and applications · cpe:a:mattermost:mattermost_server
  • From 8.1.0 before 8.1.12
  • From 9.4.0 before 9.4.5
  • From 9.5.0 before 9.5.3
  • From 9.6.0 before 9.6.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-32046
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-32046