Описание
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 8.1.0 (включая) до 8.1.12 (исключая)Версия от 9.5.0 (включая) до 9.5.3 (исключая)
Одно из
cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost_server:9.6.0:-:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost_server:9.6.0:rc1:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost_server:9.6.0:rc2:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost_server:9.6.0:rc3:*:*:*:*:*:*
EPSS
Процентиль: 41%
0.00502
Низкий
2.7 Low
CVSS3
Дефекты
CWE-284
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 2.7
redhat
больше 2 лет назад
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.
CVSS3: 2.7
debian
больше 2 лет назад
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 ...
CVSS3: 2.7
github
больше 2 лет назад
Mattermost fails to fully validate role changes
EPSS
Процентиль: 41%
0.00502
Низкий
2.7 Low
CVSS3
Дефекты
CWE-284
NVD-CWE-noinfo