CVE-2023-49874 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.

Reserved 2023-12-05 | Published 2023-12-12 | Updated 2024-08-02 | Assigner Mattermost

MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Problem types

CWE-284: Improper Access Control

Product status

Default status

unaffected

Any version

affected

Any version

affected

Any version

affected

Any version

affected

Any version

affected

9.2.2

unaffected

8.1.6

unaffected

9.0.4

unaffected

9.1.3

unaffected

7.8.15

unaffected

Credits

DoyenSec finder

References

mattermost.com/security-updates

cve.org (CVE-2023-49874)

nvd.nist.gov (CVE-2023-49874)

Download JSON

https://cve.threatint.eu/CVE/CVE-2023-49874

Support options

Helpdesk Chat, Email, Knowledgebase

MonTueWedThuFriSatSun

311234567891011121314151617181920212223242526272829301234567891011

MonTueWedThuFriSatSun

311234567891011121314151617181920212223242526272829301234567891011