Описание
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
Ссылки
- ExploitThird Party Advisory
- Vendor Advisory
- ExploitThird Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 6.5.0 (исключая)
cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
EPSS
Процентиль: 38%
0.00168
Низкий
3.7 Low
CVSS3
4.6 Medium
CVSS3
5.8 Medium
CVSS2
Дефекты
CWE-664
CWE-668
Связанные уязвимости
CVSS3: 3.7
debian
почти 4 года назад
Mattermost 6.4.x and earlier fails to properly invalidate pending emai ...
CVSS3: 4.6
github
почти 4 года назад
Improper Control of a Resource Through its Lifetime in Mattermost
EPSS
Процентиль: 38%
0.00168
Низкий
3.7 Low
CVSS3
4.6 Medium
CVSS3
5.8 Medium
CVSS2
Дефекты
CWE-664
CWE-668