CVE-2023-4106

Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:34

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.5
v2 : unknown
v3 : 6.3
Summary
  • (es) Mattermost no comprueba si el usuario solicitante es un invitado antes de realizar diferentes acciones en los libros de reproducción públicos, por lo que un invitado puede ver, unirse, editar, exportar y archivar libros de reproducción públicos.
References () https://mattermost.com/security-updates - Vendor Advisory () https://mattermost.com/security-updates - Vendor Advisory

Information

Published : 2023-08-11 07:15

Updated : 2024-11-21 08:34


NVD link : CVE-2023-4106

Mitre link : CVE-2023-4106

CVE.ORG link : CVE-2023-4106


JSON object : View

Products Affected

mattermost

  • mattermost
CWE
CWE-862

Missing Authorization