CVE-2023-4107

2023-08-1107:15:09

CWE-863

[email protected]

web.nvd.nist.gov

mattermost

cve-2023-4107

system admin

user permissions

security vulnerability

6.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

6.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.0%

JSON

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin’s details such as email, first name and last name.

Affected configurations

NVD

Node

mattermostmattermostRange7.8.0–7.8.8

mattermostmattermostRange7.9.0–7.9.6

mattermostmattermostRange7.10.0–7.10.4

CPENameOperatorVersion
mattermost:mattermostmattermostlt7.8.8
mattermost:mattermostmattermostlt7.9.6
mattermost:mattermostmattermostlt7.10.4

CPE	Name	Operator	Version
mattermost:mattermost	mattermost	lt	7.8.8
mattermost:mattermost	mattermost	lt	7.9.6
mattermost:mattermost	mattermost	lt	7.10.4

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "7.8.7",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.9.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.10.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "7.8.8"
      },
      {
        "status": "unaffected",
        "version": "7.9.6"
      },
      {
        "status": "unaffected",
        "version": "7.10.4"
      }
    ]
  }
]