CVE-2023-6458

🗓️ 06 Dec 2023 08:10:18Reported by MattermostType

cve🔗 web.nvd.nist.gov👁 218 Views🌐 WEB

Mattermost webapp allows client-side path traversal

Reporter	Title	Published	Views	Family All 20
Chainguard	CVE-2023-6458 vulnerabilities	1 May 202507:14	–	cgr
Circl	CVE-2023-6458	30 Dec 202308:01	–	circl
CNNVD	Mattermost Injection Vulnerability	6 Dec 202300:00	–	cnnvd
Cvelist	CVE-2023-6458 Client side path traversal due to lack of route parameters validation	6 Dec 202308:10	–	cvelist
EUVD	EUVD-2023-3139	3 Oct 202520:07	–	euvd
Github Security Blog	Mattermost Injection vulnerability	6 Dec 202309:30	–	github
NVD	CVE-2023-6458	6 Dec 202309:15	–	nvd
OSV	BIT-MATTERMOST-2023-6458	6 Mar 202410:57	–	osv
OSV	CGA-3VXG-FQPC-Q9M6	4 Apr 202521:19	–	osv
OSV	CGA-C667-595Q-59PJ	31 Mar 202516:03	–	osv

NVD

Node

mattermost mattermost_serverRange<7.8.14

mattermost mattermost_serverRange8.0.0–8.1.5

mattermost mattermost_serverRange9.0.0–9.0.3

mattermost mattermost_serverRange9.1.0–9.1.2

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "9.1.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.0.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.1.4",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.8.13",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "9.1.2"
      },
      {
        "status": "unaffected",
        "version": "9.0.3"
      },
      {
        "status": "unaffected",
        "version": "8.1.5"
      },
      {
        "status": "unaffected",
        "version": "7.8.14"
      }
    ]
  }
]

Source	Link
mattermost	www.mattermost.com/security-updates

Parameter	Position	Path	Description	CWE
TEAM_NAME	path	/<TEAM_NAME>/channels/<CHANNEL_NAME>	Mattermost webapp fails to validate route parameters in /<TEAM_NAME>/channels/<CHANNEL_NAME> allowing a client-side path traversal.	CWE-74, CWE-22
CHANNEL_NAME	path	/<TEAM_NAME>/channels/<CHANNEL_NAME>	Mattermost webapp fails to validate route parameters in /<TEAM_NAME>/channels/<CHANNEL_NAME> allowing a client-side path traversal.	CWE-74, CWE-22

21 Nov 2024 08:43Current

8High risk

Vulners AI Score8

CVSS 3.17.1 - 9.8

EPSS0.00464