Skip to content
OpenAdvisories
Medium WID-SEC-2023-0490 4 CVEs

Mattermost: Mehrere Schwachstellen

Published Feb 27, 2023 · Updated Feb 27, 2023 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Android Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um Informationen offenzulegen und Daten zu manipulieren.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 4

  • High 7.1
    CVE-2023-27264

    IDOR: Updating a playbook via the Playbooks API

    A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API.

    Mattermost Mattermost
  • Medium 4.3
    CVE-2023-27263

    IDOR: Accessing playbook runs via the Playbooks Runs API

    A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of.

    Mattermost Mattermost
  • Low 2.7
    CVE-2023-27265

    Disclosure of team owner email address when regenerating Invite ID

    Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.

    Mattermost Mattermost
  • Low 2.7
    CVE-2023-27266

    Disclosure of team owner email address when when accessing the teams API

    Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.

    Mattermost Mattermost

Revision history

  1. #1

    Initiale Fassung

References