GitHub Advisoryadvisory · Go

GHSA-5qx9-9ffj-5r8f Mattermost fails to fully validate role changes

LOW Published 2024-04-26 Modified 2024-04-26 Official page ↗
Aliases
CVE-2024-4198
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-284
Reviewed
2024-04-26

Affected packages

• Go github.com/mattermost/mattermost-server: >= 9.6.0-rc1, < 9.6.1 → fixed in 9.6.1 • Go github.com/mattermost/mattermost-server: >= 9.5.0, < 9.5.3 → fixed in 9.5.3 • Go github.com/mattermost/mattermost-server: >= 8.1.0, < 8.1.12 → fixed in 8.1.12

Description

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.

Related

Alias · CVE (1)

  • CVE-2024-4198 Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References