2.7
CVE-2024-4198
- EPSS 0.14%
- Published 26.04.2024 09:15:13
- Last modified 12.05.2025 13:45:11
- Source responsibledisclosure@mattermo
- Teams watchlist Login
- Open Login
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Data is provided by the National Vulnerability Database (NVD)
Mattermost ≫ Mattermost Server Version >= 8.1.0 < 8.1.12
Mattermost ≫ Mattermost Server Version >= 9.5.0 < 9.5.3
Mattermost ≫ Mattermost Server Version9.6.0 Update-
Mattermost ≫ Mattermost Server Version9.6.0 Updaterc1
Mattermost ≫ Mattermost Server Version9.6.0 Updaterc2
Mattermost ≫ Mattermost Server Version9.6.0 Updaterc3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.14% | 0.346 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 2.7 | 1.2 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
|
| responsibledisclosure@mattermost.com | 2.7 | 1.2 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.