Lucene search

Veracode Vulnerability DatabaseVERACODE:46665

HistoryApr 29, 2024 - 6:39 a.m.

Improper Access Control

2024-04-2906:39:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

mattermost server

improper access control

role changes

validation

team admins

guest promotion

crafted http requests

security vulnerability

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Mattermost Server is vulnerable to Improper Access Control. The vulnerability is due to incomplete validation of role changes within team.go, allowing an attacker authenticated as a team admin to promote guests to team admins through crafted HTTP requests.

CPENameOperatorVersion
github.com/mattermost/mattermost-serverlev9.5.3-rc3
github.com/mattermost/mattermost-serverlev8.1.12-rc3
github.com/mattermost/mattermost-serverlev9.5.3-rc3
github.com/mattermost/mattermost-serverlev8.1.12-rc3

Name	Operator	Version
github.com/mattermost/mattermost-server	le	v9.5.3-rc3
github.com/mattermost/mattermost-server	le	v8.1.12-rc3
github.com/mattermost/mattermost-server	le	v9.5.3-rc3
github.com/mattermost/mattermost-server	le	v8.1.12-rc3

References

github.com/advisories/GHSA-5fh7-7mw7-mmx5

github.com/mattermost/mattermost/commit/1e3497e0595bb4f9908c94dd9d4685d48556b7e8

github.com/mattermost/mattermost/commit/f0872dd4e4ba34f061aa6982a71c7c29532aac2e

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for VERACODE:46665