CVE-2023-1774 — Missing Authorization in Mattermost

CWE-862 — Missing Authorization7 documents7 sources
Severity
5.4MEDIUMNVD
CNA4.2
EPSS
0.2%
top 63.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
MattermostGithub.com Mattermost Mattermost-serverGithub.com Mattermost Mattermost-server V5+2 more
Timeline
PublishedMar 31
Latest updateSep 6

Description

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages5 packages

▶CVEListV5mattermost/mattermost< 7.8.0+2

🔴Vulnerability Details

3
OSV
Mattermost fails to properly authentication inviter's permissions to private channel↗2023-03-31
▶
CVEList
Unauthorized email invite to a private channel↗2023-03-31
▶
GHSA
Mattermost fails to properly authentication inviter's permissions to private channel↗2023-03-31
▶

💥Exploits & PoCs

1
Exploit-DB
FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)↗2023-05-23
▶

📋Vendor Advisories

1
Microsoft
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability↗2023-05-09
▶

🕵️Threat Intelligence

1
Talos
Eight vulnerabilities in Open Automation Software Platform could lead to information disclosure, improper authentication↗2023-09-06
▶
CVE-2023-1774 — Missing Authorization in Mattermost | cvebase