CVE-2023-50333 — Improper Access Control in Mattermost Mattermost Server V8

CWE-284 — Improper Access Control5 documents4 sources
Severity
4.3MEDIUMNVD
CNA3.7
EPSS
0.1%
top 78.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Mattermost Mattermost Server V8Mattermost ServerMattermost
Timeline
PublishedJan 2
Latest updateJun 28

Description

Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5mattermost/mattermost9.2.2+1

🔴Vulnerability Details

4
OSV
Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server↗2024-06-28
▶
GHSA
Mattermost allows demoted guests to change group names↗2024-01-02
▶
OSV
Mattermost allows demoted guests to change group names↗2024-01-02
▶
CVEList
Lack of restriction to manage group names for freshly demoted guests↗2024-01-02
▶
CVE-2023-50333 — Improper Access Control | cvebase