CVE-2023-3590
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
Risk Assessment
An attacker may gain access to sensitive data that should have been deleted, potentially leading to privacy and information security breaches.
Recommendation
It is recommended to update Mattermost to the latest version to address this vulnerability and to monitor access to attachments.
Other vulnerabilities in Mattermost Boards
See all- CVE-2023-40703Medium
Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards. An attacker can patch a block field using a specially crafted string to consume excessive resources, possibly leading to Denial of Service.
- CVE-2023-3585Medium
Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
Original NVD description (English source)
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS