Design/Logic Flaw

2022-03-1818:15:00

PRIOn knowledge base

www.prio-n.com

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.7%

JSON

One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads.

CPENameOperatorVersion
mattermostlt6.4.0

CPE	Name	Operator	Version
	mattermost	lt	6.4.0

References

mattermost.com/security-updates/