CVE-2023-4105

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-410507.7AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format sCVE-2023-410514.7In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual device drivers, virtio backend driversCVE-2023-410525.3Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256CVE-2023-410533.3Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grantCVE-2023-410549.1LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side RCVE-2023-410557.5LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side RCVE-2023-410568.1Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overfCVE-2023-410575.5hyper-bump-it is a command line tool for updating the version in project files.`hyper-bump-it` reads a file glob pattern from the configuratCVE-2023-410587.5Parse Server is an open source backend server. In affected versions the Parse Cloud trigger `beforeFind` is not invoked in certain conditionCVE-2023-41066.5Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest beingCVE-2023-410608.8A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. A remote user may bCVE-2023-410617.8A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously craf