Design/Logic Flaw

2023-12-1209:15:00

PRIOn knowledge base

www.prio-n.com

mattermost

user status

task updates

private playbook

nvd

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

14.0%

JSON

Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.

CPENameOperatorVersion
mattermost_serverge9.2.0
mattermost_serverle9.2.1
mattermost_serverle7.8.14
mattermost_serverge9.0.0
mattermost_serverle9.0.3
mattermost_serverge8.0.0
mattermost_serverle8.1.5
mattermost_serverge9.1.1
mattermost_serverle9.1.2

Name	Operator	Version
mattermost_server	ge	9.2.0
mattermost_server	le	9.2.1
mattermost_server	le	7.8.14
mattermost_server	ge	9.0.0
mattermost_server	le	9.0.3
mattermost_server	ge	8.0.0
mattermost_server	le	8.1.5
mattermost_server	ge	9.1.1
mattermost_server	le	9.1.2

References

mattermost.com/security-updates