CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
EPSS
Percentile
17.2%
Mattermost versions 9.5.x <= 9.5.5 and 9.8.0,Β when using shared channels with multiple remote servers connected,Β fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one .Β This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.
[
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"status": "affected",
"version": "9.8.0"
},
{
"lessThanOrEqual": "9.5.5",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "9.9.0"
},
{
"status": "unaffected",
"version": "9.8.1"
},
{
"status": "unaffected",
"version": "9.5.6"
}
]
}
]