Summary
Ein Angreifer kann eine Schwachstelle in Mattermost ausnutzen, um Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und einen Denial of Service zu verursachen.
Product
Mattermost ist ein webbasierter Instant-Messaging-Dienst.
Vulnerabilities 4
-
Medium 6.7
Incorrect authorization allows a user manager to update a system admin
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.
-
Medium 6.3
A guest user can perform various actions on public playbooks
Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.
-
Medium 4.5
Audit logging fails to sanitize post metadata
Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged
-
Low 3.1
Attachment of deleted message in a thread remains accessible and downloadable
Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message
Revision history
-
#2
Neue Informationen von Mattermost aufgenommen
-
#1
Initiale Fassung
References
-
NIST Vulnerability Database
https://nvd.nist.gov/vuln/detail/CVE-2023-4105
-
NIST Vulnerability Database
https://nvd.nist.gov/vuln/detail/CVE-2023-4106
-
NIST Vulnerability Database
https://nvd.nist.gov/vuln/detail/CVE-2023-4107
-
NIST Vulnerability Database
https://nvd.nist.gov/vuln/detail/CVE-2023-4108
-
Mattermost Security Updates vom 2023-07-12
https://mattermost.com/security-updates/