2.7
CVE-2024-4198
- EPSS 0.5%
- Veröffentlicht 26.04.2024 09:15:13
- Zuletzt bearbeitet 12.05.2025 13:45:11
- Erkennungen
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mattermost ≫ Mattermost Server Version >= 8.1.0 < 8.1.12
Mattermost ≫ Mattermost Server Version >= 9.5.0 < 9.5.3
Mattermost ≫ Mattermost Server Version 9.6.0 Update -
Mattermost ≫ Mattermost Server Version 9.6.0 Update rc1
Mattermost ≫ Mattermost Server Version 9.6.0 Update rc2
Mattermost ≫ Mattermost Server Version 9.6.0 Update rc3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.5% | 0.389 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 2.7 | 1.2 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
|
| responsibledisclosure@mattermost.com | 2.7 | 1.2 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
https://mattermost.com/security-updates