CVE-2023-3584
published 2023-07-17CVE-2023-3584: Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated…
PriorityP414low3.1CVSS 3.1
AVNACHPRLUINSUCNILAN
EPSS
0.35%
27.7th percentile
Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mattermost | mattermost | <= 7.8.4 | — |
| mattermost | mattermost_server | >= 7.10.0 < 7.10.3 | 7.10.3 |
| mattermost | mattermost_server | >= 7.8.0 < 7.8.5 | 7.8.5 |
| tinacms | cli | >= 1.0.0 < 1.0.9 | 1.0.9 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w2wm-ccwh-3737: Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenti
ghsa_unreviewed·2023-07-17
CVE-2023-3584 [LOW] CWE-863 GHSA-w2wm-ccwh-3737: Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenti
Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme.
GHSA
Sensitive Information leak via Script File in TinaCMS
ghsa·2023-02-08
CVE-2023-25164 [HIGH] CWE-200 Sensitive Information leak via Script File in TinaCMS
Sensitive Information leak via Script File in TinaCMS
### Impact
Sensitive Information leaked via script File in TinaCMS. Sites building with @tinacms/cli >= 1.0.0 && < 1.0.9 that store sensitive values in process.env var are impacted. If you're on a version prior to 1.0.0 this vulnerability does not affect you.
If your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately.
### Patches
This issue has been patched in @tinacms/[email protected]
### Workarounds
Upgrading, and rotating secure & exposed keys is required for the proper fix.
### References
https://github.com/tinacms/tinacms/pull/3584
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-07-17
Published