Mattermost Calls Plugin Sensitive Data Exposure Vulnerability

A vulnerability exists in the Mattermost Calls plugin for Mattermost versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3. The issue arises because these versions do not properly sanitize sensitive configuration fields, allowing an attacker with access to a support packet to retrieve TURN server credentials from the unencrypted plugin configuration. This vulnerability could lead to unauthorized access to TURN server resources.

Impact

Exploitation of this vulnerability could result in unauthorized access to TURN server credentials, potentially allowing an attacker to misuse TURN server resources.

Remediation

Users can upgrade to Mattermost versions 11.7.0, 11.6.1, or 10.11.15 to address this vulnerability.