DeutschShown in its original language — a full translation is planned for a future version.
Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
view advisory published 2023-10-29
Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-6202US | medium4.3 | — | ||
Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get t… | ||||
| CVE-2023-48369US | medium5.3 | — | ||
Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.
| ||||
| CVE-2023-48268US | high7.5 | — | ||
Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possib… | ||||
| CVE-2023-47168US | medium6.1 | — | ||
Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom u… | ||||
| CVE-2023-45223US | medium4.3 | — | ||
Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show F… | ||||
| CVE-2023-43754US | medium4.3 | — | ||
Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of… | ||||
| CVE-2023-40703US | high7.5 | — | ||
Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading t… | ||||
| CVE-2023-35075US | medium5.4 | — | ||
Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a… | ||||
| CVE-2023-47865US | medium4.3 | — | ||
Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username an… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan