Authorization

2020-06-1917:15:00

PRIOn knowledge base

www.prio-n.com

9.3 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.7%

JSON

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.

CPENameOperatorVersion
mattermost_servereq5.2.0 rc2
mattermost_servereq5.2.0 rc3
mattermost_servereq5.2.0 rc4
mattermost_servereq5.2.0 rc5
mattermost_servereq5.2.0 rc6
mattermost_servereq5.2.0 rc1
mattermost_serverlt5.1.1

Name	Operator	Version
mattermost_server	eq	5.2.0 rc2
mattermost_server	eq	5.2.0 rc3
mattermost_server	eq	5.2.0 rc4
mattermost_server	eq	5.2.0 rc5
mattermost_server	eq	5.2.0 rc6
mattermost_server	eq	5.2.0 rc1
mattermost_server	lt	5.1.1

References

mattermost.com/security-updates/