DeutschShown in its original language — a full translation is planned for a future version.
Mattermost: Mehrere Schwachstellen
view advisory published 2023-06-15
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-3613US | low3.5OT elevated | — | ||
Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by defa… | ||||
| CVE-2023-3593US | medium6.5 | — | ||
Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.
| ||||
| CVE-2023-3591US | high8.2 | — | ||
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
| ||||
| CVE-2023-3590US | high7.5OT elevated | — | ||
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
| ||||
| CVE-2023-3587US | low2.7OT elevated | — | ||
Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor a… | ||||
| CVE-2023-3586US | medium5.4OT elevated | — | ||
Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessi… | ||||
| CVE-2023-3585US | medium4.3 | — | ||
Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
| ||||
| CVE-2023-3582US | medium4.3OT elevated | — | ||
Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have ac… | ||||
| CVE-2023-3581US | high8.1 | — | ||
Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs.
| ||||
| CVE-2023-3577US | medium4.3 | — | ||
Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF.
| ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan