Lucene search

GoogleOSV:CVE-2023-48732

HistoryJan 02, 2024 - 10:15 a.m.

CVE-2023-48732

2024-01-0210:15:08

Google

osv.dev

mattermost

websocket

notified users

broadcasting

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

6.5 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

13.4%

JSON

Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.

CPENameOperatorVersion
mattermost-servereq4.5.0-rc2
mattermost-servereq4.0.1
mattermost-servereq8.1.1-rc1
mattermost-servereq0.6.0
mattermost-servereq4.7.2
mattermost-servereq5.0.0-rc7
mattermost-servereq5.2.0
mattermost-servereq8.1.7-rc1
mattermost-servereq@mattermost/[email protected]
mattermost-servereq4.5.0-rc4

Name	Operator	Version
mattermost-server	eq	4.5.0-rc2
mattermost-server	eq	4.0.1
mattermost-server	eq	8.1.1-rc1
mattermost-server	eq	0.6.0
mattermost-server	eq	4.7.2
mattermost-server	eq	5.0.0-rc7
mattermost-server	eq	5.2.0
mattermost-server	eq	8.1.7-rc1
mattermost-server	eq	@mattermost/[email protected]
mattermost-server	eq	4.5.0-rc4

Rows per page:

1-10 of 1531

References

mattermost.com/security-updates

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

6.5 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

13.4%

JSON

Related for OSV:CVE-2023-48732