CVE-2023-27265
Disclosure of team owner email address when regenerating Invite ID
概要
Disclosure of team owner email address when regenerating Invite ID
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com