En bref
- CVE-2024-4195 est une vulnérabilité FAIBLE (CVSS 2.7) touchant github.com/mattermost/mattermost-server, mattermost server (mattermost).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.50%, plus élevée que 43.0% des vulnérabilités.
- Correctif : mettre à jour vers 8.1.12, 8.1.12+incompatible, 9.5.3, 9.5.3+incompatible ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| github.com/mattermost/mattermost-server Go | ≥ 8.1.0, < 8.1.12≥ 8.1.0+incompatible, < 8.1.12+incompatible≥ 9.5.0, < 9.5.3≥ 9.5.0+incompatible, < 9.5.3+incompatible
| 8.1.128.1.12+incompatible9.5.39.5.3+incompatible
|
| mattermost server | ≥ 8.1.0, < 8.1.12≥ 9.5.0, < 9.5.3
| 8.1.129.5.3
|
Description
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.
NVD description
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.
Autres vulnérabilités de github.com/mattermost/mattermost-server
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free