Description
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mattermost Mattermost
Default version status: unaffected
10.8.0 to ≤ 10.8.3affected10.5.0 to ≤ 10.5.8affected9.11.0 to ≤ 9.11.17affected10.10.0 to ≤ 10.10.1affected10.9.0 to ≤ 10.9.3affected10.11.0unaffected10.8.4unaffected10.5.9unaffected9.11.18unaffected10.10.2unaffected10.9.4unaffected