Lucene search
MattermostCVELIST:CVE-2023-2791HistoryJun 16, 2023 - 8:59 a.m.
CVE-2023-2791 Playbooks lets you edit arbitrary posts
2023-06-1608:59:16
CWE-862
Mattermost
www.cve.org
3
cve-2023-2791
playbooks
arbitrary post edits
/dialog api
mattermost
CVSS3
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
AI Score
4.9
Confidence
High
EPSS
0.001
Percentile
17.7%
When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThan": "7.9.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.8.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.7.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.10.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.9.2"
},
{
"status": "unaffected",
"version": "7.8.3"
},
{
"status": "unaffected",
"version": "7.7.4"
},
{
"status": "unaffected",
"version": "7.10.1"
}
]
}
]References
Related
nvd
nvd
CVE-2023-2791
2023-06-16 09:15:10
osv
osv
CVE-2023-2791
2023-06-16 09:15:10
veracode
veracode
Missing Authorization
2023-06-28 04:44:34
cve
cve
CVE-2023-2791
2023-06-16 09:15:10
prion
prion
Code injection
2023-06-16 09:15:00
CVSS3
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
AI Score
4.9
Confidence
High
EPSS
0.001
Percentile
17.7%
Related for CVELIST:CVE-2023-2791