CVE-2023-2792
Ephemeral messages return private channel contents in permalink previews
Summary
Ephemeral messages return private channel contents in permalink previews
Original description
The description as published by the source.
Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command.
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com