Описание
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 6.3.8 (исключая)Версия от 6.4.0 (включая) до 6.5.1 (включая)
Одно из
cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost:6.6.0:*:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost:6.6.1:*:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost:6.7.0:*:*:*:*:*:*:*
EPSS
Процентиль: 36%
0.00143
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-200
CWE-863
Связанные уязвимости
CVSS3: 4.3
debian
почти 3 года назад
The Guest account feature in Mattermost version 6.7.0 and earlier fail ...
CVSS3: 4.3
github
почти 3 года назад
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
EPSS
Процентиль: 36%
0.00143
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-200
CWE-863