CVE-2023-6202

2023-11-2710:15:08

CWE-284

[email protected]

web.nvd.nist.gov

cve-2023-6202

mattermost

authorization

vulnerability

api

user information

security exploit

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.

Affected configurations

NVD

Node

mattermostmattermostRange≤7.8.12

mattermostmattermostRange8.0.0–8.1.3

CPENameOperatorVersion
mattermost:mattermostmattermostle7.8.12
mattermost:mattermostmattermostle8.1.3

CPE	Name	Operator	Version
mattermost:mattermost	mattermost	le	7.8.12
mattermost:mattermost	mattermost	le	8.1.3

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "7.8.12",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.1.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.0.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.1.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "9.0.2"
      },
      {
        "status": "unaffected",
        "version": "9.1.1"
      },
      {
        "status": "unaffected",
        "version": "7.8.13"
      },
      {
        "status": "unaffected",
        "version": "8.1.4"
      }
    ]
  }
]