CVE-2022-1003lowCWE-268

Sysadmin can override existing configs & bypass restrictions like EnableUploads

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.3epss 0.5%

probabilidade de exploração

0.5%top 60% das CVEs

exploração observada

nãonenhuma fonte reporta

One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads.

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Produtos afetados

Mattermost · Mattermost

Referências

https://mattermost.com/security-updates/