Lucene search

Veracode Vulnerability DatabaseVERACODE:47222

HistoryMay 28, 2024 - 11:46 a.m.

Improper Authorization

2024-05-2811:46:55

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

mattermost

improper authorization

vulnerability

authorization checks

channel admin

playbook

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

mattermost is vulnerable to Improper Authorization. The vulnerability is due to a failure to perform proper authorization checks, allowing a member running a playbook in an existing channel to be promoted to a channel admin.

CPENameOperatorVersion
github.com/mattermost/mattermost-plugin-playbookslev1.39.1
github.com/mattermost/mattermost-plugin-playbookslev1.39.1

CPE	Name	Operator	Version
	github.com/mattermost/mattermost-plugin-playbooks	le	v1.39.1
	github.com/mattermost/mattermost-plugin-playbooks	le	v1.39.1

References

github.com/mattermost/mattermost-plugin-playbooks/commit/939af55b1d82b2f177a0142c81ca5e6e7784625f

mattermost.com/security-updates

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for VERACODE:47222