Skip to content
OpenAdvisories
Medium WID-SEC-2023-0955 2 CVEs

Mattermost Server: Mehrere Schwachstellen

Published Apr 12, 2023 · Updated May 14, 2023 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Product: Mattermost Server < 7.1.8 Product: Mattermost Server < 7.7.4 Product: Mattermost Server < 7.8.3 Product: Mattermost Server < 7.9.2 Platform: Linux Platform: Windows

Summary

Ein authentisierter Angreifer kann mehrere Schwachstellen im Mattermost Server ausnutzen, um Informationen offenzulegen und um seine Privilegien zu erweitern.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 2

  • Medium 6.7
    CVE-2023-2514

    DB username/password revealed in application logs

    Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. 

    Mattermost Mattermost
  • Medium 4.7
    CVE-2023-2515

    Privilege escalation to system admin via personal access tokens

    Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin

    Mattermost Mattermost github.com/mattermost/mattermost-server/v6 Go

Revision history

  1. #2

    Aktualisierung Schwachstellenbeschreibungen anhand Mattermost Advisory

  2. #1

    Initiale Fassung

References