Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Summary

Product

Vulnerabilities 3

• Medium 4.3
  CVE-2025-20033

  DoS via custom post type for sysconsole plugin readers

  Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notificat…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Jan 9, 2025
• Low 3.8
  CVE-2025-22449

  Access control flaw for team admins allows unauthorized team additions

  Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Jan 9, 2025
• Low 3.5
  CVE-2025-22445

  Misleading UI for undefined admin console settings in Calls causes security confusion

  Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Jan 9, 2025

Revision history

1. 2025-01-15 #3

   Neue Updates von openSUSE aufgenommen

2. 2025-01-09 #2

   CVE's ergänzt

3. 2024-12-11 #1

   Initiale Fassung

References

• Mattermost Security Updates vom 2024-12-11
  https://mattermost.com/security-updates/
• openSUSE Security Update OPENSUSE-SU-2025:14644-1 vom 2025-01-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/L4N4W6VRBQ6LXRMKE4XQATP6QUUXHQOR/