441 matches found
CVE-2024-31859 Member promoted to channel admin via playbooks run linking to channel
Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin...
CVE-2024-5272 Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"
Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1, 8.1.x = 8.1.12 fail to restrict the audience of the "customplaybooksplaybookrunupdated" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished...
CVE-2024-5272 Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"
Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1, 8.1.x = 8.1.12 fail to restrict the audience of the "customplaybooksplaybookrunupdated" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished...
CVE-2024-32045
Mattermost Server vulnerability CVE-2024-32045: improper access control for channel and team membership when linking a playbook run to a channel. Affected versions are Mattermost 8.1.x <= 8.1.12, 9.5.x <= 9.5.3, and 9.6.x
CVE-2024-32045 Playbook run link to private channel grants channel access
Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1, 8.1.x = 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of...
CVE-2024-32045 Playbook run link to private channel grants channel access
Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1, 8.1.x = 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of...
CVE-2024-32045 Playbook run link to private channel grants channel access
Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1, 8.1.x = 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of...
CVE-2024-34152 Playbook Run Metadata leak to Guest
Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that linked to the channel they are guest via sending an RHSRuns GraphQL query request to the server...
CVE-2024-34152 Playbook Run Metadata leak to Guest
Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that linked to the channel they are guest via sending an RHSRuns GraphQL query request to the server...
PT-2024-35417 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1 Description: The issue is related to the "custom playbooks playbook run updated" webhook event, where guests on a channel...
Mattermost Server安全漏洞
Mattermost Server is an open source messaging platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost Server that stems from an inability to enforce proper access control, which could allow users to view arbitrary post content via the /playbook addlashes...
PT-2024-26924 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1 Description: The issue is related to a failure in enforcing proper access controls, allowing users to view arbitrary post...
PT-2024-24374 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1 Description: The issue is related to improper access controls for channel and team membership when linking a playbook run...
PT-2024-25722 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1 Description: The issue is related to improper access control, allowing a guest to obtain metadata of a public playbook ru...
PT-2024-26935 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1 Description: The issue arises from inadequate input validation on post actions, allowing an attacker to execute a playboo...
PT-2024-24246 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1 Description: The issue is related to improper authorization checks. This allows a member running a playbook in an existin...
SUSE-SU-2024:1525-1 Security update for SUSE Manager Salt Bundle
This update fixes the following issues: venv-salt-minion: - CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master bsc1219430 - CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method bsc1219431 - Convert oscap output to UTF-8 -...
SUSE-SU-2024:1518-1 Security update for SUSE Manager Salt Bundle
This update fixes the following issues: venv-salt-minion: - Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master bsc1219430 CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method bsc1219431 - Bugs fixed...
SUSE-SU-2024:1517-1 Security update for SUSE Manager Salt Bundle
This update fixes the following issues: venv-salt-minion: - Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master bsc1219430 CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method bsc1219431 - Bugs fixed...
