Lucene search

GoogleOSV:CVE-2023-49874

HistoryDec 12, 2023 - 9:15 a.m.

CVE-2023-49874

2023-12-1209:15:09

Google

osv.dev

mattermost

guest user

private playbook

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.

CPENameOperatorVersion
mattermosteq9.1.1-rc1
mattermosteq9.1.2-rc1
mattermosteq9.0.1
mattermosteq9.0.3
mattermosteq9.1.2
mattermosteq9.0.1-rc1
mattermosteq9.0.3-rc1
mattermosteq9.1.1
mattermosteq9.2.0-rc2
mattermosteq9.0.2-rc1

Name	Operator	Version
mattermost	eq	9.1.1-rc1
mattermost	eq	9.1.2-rc1
mattermost	eq	9.0.1
mattermost	eq	9.0.3
mattermost	eq	9.1.2
mattermost	eq	9.0.1-rc1
mattermost	eq	9.0.3-rc1
mattermost	eq	9.1.1
mattermost	eq	9.2.0-rc2
mattermost	eq	9.0.2-rc1

Rows per page:

1-10 of 191

References

mattermost.com/security-updates

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

Related for OSV:CVE-2023-49874