DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Mattermost: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-06-15
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.
01
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-3613US | low3.5OT erhöht | — | ||
Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by defa… | ||||
| CVE-2023-3593US | medium6.5 | — | ||
Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.
| ||||
| CVE-2023-3591US | high8.2 | — | ||
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
| ||||
| CVE-2023-3590US | high7.5OT erhöht | — | ||
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
| ||||
| CVE-2023-3587US | low2.7OT erhöht | — | ||
Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor a… | ||||
| CVE-2023-3586US | medium5.4OT erhöht | — | ||
Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessi… | ||||
| CVE-2023-3585US | medium4.3 | — | ||
Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
| ||||
| CVE-2023-3582US | medium4.3OT erhöht | — | ||
Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have ac… | ||||
| CVE-2023-3581US | high8.1 | — | ||
Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs.
| ||||
| CVE-2023-3577US | medium4.3 | — | ||
Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF.
| ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan