Skip to content
OpenAdvisories
Medium WID-SEC-2024-0718 6 CVEs

Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Mar 26, 2024 · Updated Apr 28, 2024 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 6

  • Medium 4.3
    CVE-2024-32046

    Detailed error discloses full file path with dev mode off

    Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path …

    Mattermost Mattermost github.com/mattermost/mattermost-server Go
  • Medium 4.3
    CVE-2024-4182

    Mattermost crashes web clients via a malformed custom status

    Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.

    Mattermost Mattermost github.com/mattermost/mattermost-server Go
  • Medium 4.3
    CVE-2024-4183

    Mattermost fails to limit the number of active sessions

    Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after floo…

    Mattermost Mattermost github.com/mattermost/mattermost-server Go
  • Low 3.1
    CVE-2024-22091

    Excessive resource consumption due to lack to request path size limits

    Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending …

    Mattermost Mattermost github.com/mattermost/mattermost-server Go
  • Low 2.7
    CVE-2024-4195

    Mattermost allows team admins to promote guests to team admins

    Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.

    Mattermost Mattermost github.com/mattermost/mattermost-server Go
  • Low 2.7
    CVE-2024-4198

    Mattermost fails to fully validate role changes

    Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.

    Mattermost Mattermost github.com/mattermost/mattermost-server Go

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References