CVE-2023-47865 — Improper Access Control in Mattermost Mattermost-server V6

CWE-284 — Improper Access Control4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 71.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Mattermost Mattermost-server V6Github.com Mattermost Mattermost Server V8Mattermost
Timeline
PublishedNov 27

Description

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the Hardened Mode setting was enabled

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5mattermost/mattermost8.1.3+1
▶NVDmattermost/mattermost8.0.0 — 8.1.3+1

🔴Vulnerability Details

3
OSV
Mattermost Improper Access Control vulnerability↗2023-11-27
▶
CVEList
Username and Icon override can be used by members when Hardened Mode is enabled↗2023-11-27
▶
GHSA
Mattermost Improper Access Control vulnerability↗2023-11-27
▶
CVE-2023-47865 — Improper Access Control | cvebase