CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS
Percentile
17.2%
Mattermost versions 9.5.x <= 9.5.5 and 9.8.0,Β when using shared channels with multiple remote servers connected,Β fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one .Β This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.
Vendor | Product | Version | CPE |
---|---|---|---|
mattermost | mattermost | * | cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* |
mattermost | mattermost | 9.8.0 | cpe:2.3:a:mattermost:mattermost:9.8.0:*:*:*:*:*:*:* |