Lucene search

K
cvelistMattermostCVELIST:CVE-2023-4106
HistoryAug 11, 2023 - 6:12 a.m.

CVE-2023-4106 A guest user can perform various actions on public playbooks

2023-08-1106:12:11
CWE-862
Mattermost
www.cve.org
1
cve-2023-4106
guest user
public playbooks
view
join
edit
export
archive

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

6.8 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able toΒ view, join, edit, export and archive public playbooks.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "7.8.7",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.9.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.10.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "7.8.8"
      },
      {
        "status": "unaffected",
        "version": "7.9.6"
      },
      {
        "status": "unaffected",
        "version": "7.10.4"
      }
    ]
  }
]

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

6.8 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

Related for CVELIST:CVE-2023-4106