CVE-2024-32046

{"id": "CVE-2024-32046", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-04-26T09:15:12.157", "references": [{"url": "https://mattermost.com/security-updates", "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored\n\n"}, {"lang": "es", "value": "Las versiones de Mattermost 9.6.x &lt;= 9.6.0, 9.5.x &lt;= 9.5.2, 9.4.x &lt;= 9.4.4 y 8.1.x &lt;= 8.1.11 no eliminan mensajes de error detallados en las solicitudes de API, incluso si el desarrollador El modo est\u00e1 desactivado, lo que permite a un atacante obtener informaci\u00f3n sobre el servidor, como la ruta completa donde se almacenan los archivos."}], "lastModified": "2024-04-26T12:58:17.720", "sourceIdentifier": "responsibledisclosure@mattermost.com"}