CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AI Score
Confidence
High
Mattermost versions 9.5.x <= 9.5.5 and 9.8.0,Β when using shared channels with multiple remote servers connected,Β fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one .Β This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.