2.7
CVE-2024-4198
- EPSS 0.14%
- Veröffentlicht 26.04.2024 09:15:13
- Zuletzt bearbeitet 12.05.2025 13:45:11
- Quelle responsibledisclosure@mattermo
- CVE-Watchlists
- Unerledigt
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mattermost ≫ Mattermost Server Version >= 8.1.0 < 8.1.12
Mattermost ≫ Mattermost Server Version >= 9.5.0 < 9.5.3
Mattermost ≫ Mattermost Server Version9.6.0 Update-
Mattermost ≫ Mattermost Server Version9.6.0 Updaterc1
Mattermost ≫ Mattermost Server Version9.6.0 Updaterc2
Mattermost ≫ Mattermost Server Version9.6.0 Updaterc3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.14% | 0.345 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 2.7 | 1.2 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
|
| responsibledisclosure@mattermost.com | 2.7 | 1.2 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.