CVE-2023-5193 System Role with manage posts permission can read posts of Direct Messages

2023-09-2909:23:47

CWE-863

Mattermost

www.cve.org

mattermost

cve-2023-5193

post read

permission issue

dm conversation

system role

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "8.0.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.8.9",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.1.0"
      },
      {
        "status": "unaffected",
        "version": "8.0.2"
      },
      {
        "status": "unaffected",
        "version": "8.1.1"
      },
      {
        "status": "unaffected",
        "version": "7.8.10"
      }
    ]
  }
]