9.8

CVE-2018-21251

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mattermost ≫ Mattermost Server Version < 5.1.1
Mattermost ≫ Mattermost Server Version 5.2.0 Update rc1
Mattermost ≫ Mattermost Server Version 5.2.0 Update rc2
Mattermost ≫ Mattermost Server Version 5.2.0 Update rc3
Mattermost ≫ Mattermost Server Version 5.2.0 Update rc4
Mattermost ≫ Mattermost Server Version 5.2.0 Update rc5
Mattermost ≫ Mattermost Server Version 5.2.0 Update rc6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.2% 0.641
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://mattermost.com/security-updates/
Vendor Advisory