Medium WID-SEC-2023-2252 6 CVEs

Mattermost: Mehrere Schwachstellen

Published Sep 3, 2023 · Updated Oct 3, 2023 · Revision 3 · de-DE

Vendor: Mattermost Product: Mattermost Product: Mattermost < v7.8.10 Product: Mattermost < v8.0.2 Product: Mattermost < v8.1.1 Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder Sicherheitsvorkehrungen zu umgehen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 6

Medium 6.5

CVE-2023-5195

A team member can soft delete other teams that they are not part of

Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of

Mattermost Mattermost github.com/mattermost/mattermost-server/v6 github.com/mattermost/mattermost/server/v8 Go

Sep 29, 2023
Medium 6.5

CVE-2023-5196

DoS via Channel Notification Properties

Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming tempor…

Mattermost Mattermost github.com/mattermost/mattermost-server/v6 github.com/mattermost/mattermost/server/v8 Go

Sep 29, 2023
Medium 4.9

CVE-2023-5193

System Role with manage posts permission can read posts of Direct Messages

Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation.

Mattermost Mattermost github.com/mattermost/mattermost-server/v6 github.com/mattermost/mattermost/server/v8 Go

Sep 29, 2023
Medium 4.3

CVE-2023-5160

Full name disclosure via team top membership with Show Full Name option disabled

Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled

Mattermost Mattermost

Oct 2, 2023
Low 3.8

CVE-2023-5159

A User Manager role with user edit permissions could manage/update bots

Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots.

Mattermost Mattermost github.com/mattermost/mattermost-server/v6 github.com/mattermost/mattermost/server/v8 Go

Sep 29, 2023
Low 2.7

CVE-2023-5194

A system/user manager can demote / deactivate another manager

Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager

Mattermost Mattermost github.com/mattermost/mattermost-server/v6 github.com/mattermost/mattermost/server/v8 Go

Sep 29, 2023

Revision history

2023-10-03 #3
CVE ergänzt
2023-10-01 #2
weitere Informationen aufgenommen
2023-09-03 #1
Initiale Fassung

References

GitHub Advisory Database vom 2023-09-03
https://github.com/advisories/GHSA-33r7-wjfc-7w98
GitHub Advisory Database vom 2023-09-03
https://github.com/advisories/GHSA-9hwp-cj7m-wjw4
GitHub Advisory Database vom 2023-09-03
https://github.com/advisories/GHSA-h69v-mvh9-hfrq
GitHub Advisory Database vom 2023-09-03
https://github.com/advisories/GHSA-h8wh-f7gw-fwpr
GitHub Advisory Database vom 2023-09-03
https://github.com/advisories/GHSA-rp65-jpc7-8h8p
Mattermost Security Updates vom 2023-09-03
https://mattermost.com/security-updates/