Medium WID-SEC-2024-0569 2 CVEs

Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Mar 6, 2024 · Updated Apr 10, 2024 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 2

Medium 4.7

CVE-2024-29221

Invite ID available to team admins even without the "Add Members" permission

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their tea…

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

Apr 5, 2024
Low 3.1

CVE-2024-21848

Users maintain access to active call after being removed from a channel

Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

Apr 5, 2024

Revision history

2024-04-10 #2
CVE's ergänzt
2024-03-06 #1
Initiale Fassung

References

Mattermost Security Updates vom 2024-03-06
https://mattermost.com/security-updates/