CVE-2023-50333
published 2024-01-02CVE-2023-50333: Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group…
PriorityP418medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.32%
24.4th percentile
Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.1.7 | 8.1.7 |
| mattermost | mattermost | <= 9.2.2 | — |
| mattermost | mattermost_server | < 8.1.7 | 8.1.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server
osv·2024-06-28
CVE-2023-50333 Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server
Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server
Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.7.
GHSA
Mattermost allows demoted guests to change group names
ghsa·2024-01-02
CVE-2023-50333 [LOW] CWE-284 Mattermost allows demoted guests to change group names
Mattermost allows demoted guests to change group names
Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.
OSV
Mattermost allows demoted guests to change group names
osv·2024-01-02
CVE-2023-50333 [LOW] Mattermost allows demoted guests to change group names
Mattermost allows demoted guests to change group names
Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-01-02
Published