CVE-2024-5272

May 26, 2024, 2:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Mattermost

  • 9.5.x <= 9.5.3
  • 9.6.x <= 9.6.1
  • 8.1.x <= 8.1.12

Source

responsibledisclosure@mattermost.com

Tags

CVE-2024-5272 details

Published : May 26, 2024, 2:15 p.m.
Last Modified : May 26, 2024, 2:15 p.m.

Description

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished.

CVSS Score

1 2 3 4.3 5 6 7 8 9 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

Base Score

4.3

Exploitability Score

Impact Score

Base Severity

MEDIUM

References

URL Source
https://mattermost.com/security-updates responsibledisclosure@mattermost.com
This website uses the NVD API, but is not approved or certified by it.