Lucene search

MattermostCVELIST:CVE-2023-5875

HistoryNov 02, 2023 - 8:27 a.m.

CVE-2023-5875 Lack of Hardening against media exploitation from a remote origin

2023-11-0208:27:05

CWE-693

Mattermost

www.cve.org

mattermost

desktop

hardening

media exploitation

remote origin

permissions

user consent

sensitive information

malicious server

vulnerability

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious mattermost server

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost Desktop",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "5.5.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.5.1"
      }
    ]
  }
]

References

mattermost.com/security-updates

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Related for CVELIST:CVE-2023-5875