Summary
Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Product
Mattermost ist ein webbasierter Instant-Messaging-Dienst.
Vulnerabilities 5
-
Medium 4.3
Public channel post content accessible without membership when compliance export is enabled
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
-
Medium 4.3
Existing server guests invited to the team by members without "invite_guest" permission
Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another t…
-
Medium 4.3
Team associated AD/LDAP Groups Leaked due to missing authorization
Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of.
-
Medium 4.3
Excessive resource consumption when sending long emoji names in user custom status
Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.
-
Low 3.1
Files of archived channels accessible with the “Allow users to view archived channels” option disabled
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.
Revision history
-
#2
CVE's ergänzt
-
#1
Initiale Fassung
References
-
Security Updates vom 2024-01-30
https://mattermost.com/security-updates/