Veracode Vulnerability DatabaseVERACODE:42762Incorrect Authorization
6.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
0.0005 Low
EPSS
Percentile
16.0%
github.com/mattermost/mattermost-server is vulnerable to Incorrect Authorization. The vulnerability exists because the library does not properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin’s details such as email, first name and last name.
References
github.com/advisories/GHSA-6xjj-v76v-fwpj
github.com/mattermost/mattermost/commit/53a8df992deeb041b984aad5bf74b0cc6efce19e
github.com/mattermost/mattermost/commit/8cf951f3c18eecfc4df2270aa02c23e71061aa0d
github.com/mattermost/mattermost/commit/e401329e178532e85b6750aac7ff9741bb9a3e19
mattermost.com/security-updates
mattermost.com/security-updates/
Related
6.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
0.0005 Low
EPSS
Percentile
16.0%