Summary
Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Product
Mattermost ist ein webbasierter Instant-Messaging-Dienst.
Vulnerabilities 4
-
Medium 4.3
Denial of service in mattermost mobile apps and server via emoji reactions
Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobil…
-
Low 3.5
CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)
Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.
-
Low 3.4
Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)
Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Ji…
-
Low 3.1
Incorrect Authorization leads to Channel Member Count Leak
Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions.
Revision history
-
#2
CVE's ergänzt
-
#1
Initiale Fassung
References
-
Mattermost Security Updates 2024-01-09 vom 2024-01-09
https://mattermost.com/security-updates/