Threats tagged 'ghsa-wfp9-hhgh-rm6p'

Mattermost versions 11.7.x up to 11.7.10 have a vulnerability where outbound internal-connection filtering is not applied to the OpenID discovery endpoint request. This flaw allows a System Administrator to determine if internal addresses and ports are reachable from the server by triggering an unauthenticated login request that initiates the discovery fetch. The issue is classified as low severity with a CVSS score of 2.7.