DeutschShown in its original language — a full translation is planned for a future version.
Mattermost: Mehrere Schwachstellen
view advisory published 2023-03-01
Ein authentisierter Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um Informationen offenzulegen, einen Cross-Site Scripting Angriff durchzuführen und Sicherheitsvorkehrungen zu umgehen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-1777US | medium5.3 | — | ||
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.
| ||||
| CVE-2023-1776US | medium5.4 | — | ||
Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.
| ||||
| CVE-2023-1775US | medium6.5 | — | ||
When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of se… | ||||
| CVE-2023-1774US | medium5.4OT elevated | — | ||
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan