CPE Details
Mattermost Server 9.10.1 Release Candidate 1
9.10.1
2024-09-04
17h39 +00:00
17h39 +00:00
2024-09-04
17h39 +00:00
17h39 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:mattermost:mattermost_server:9.10.1:rc1:*:*:*:*:*:*
Informations
Vendor
mattermostProduct
mattermost_serverVersion
9.10.1Update
rc1Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
| Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels. | 4.3 |
Medium |
||
| Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks | 4.6 |
Medium |
||
| Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files. | 5.4 |
Medium |
