CVE-2023-5194
Assigner: Mattermost
Published: 2023-09-29T09:28:50.676Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions: lessThanOrEqual: 8.1.0
status: affected
version: 0
versionType: semver
lessThanOrEqual: 7.8.9
status: affected
version: 0
versionType: semver
status: unaffected
version: 8.1.1
status: unaffected
version: 7.8.10
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Pyae Phyo (pyae_phyo)
descriptions: supportingMedia: base64: no
type: text/html
value: <p>Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a&nbsp;system/user manager to demote / deactivate another manager</p>
value: Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-863
description: CWE-863 Incorrect Authorization
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: <p>Update Mattermost Server to versions <span style="background-color: rgb(255, 255, 255);">8.1.1, 7.8.10</span> or higher.</p>
value: Update Mattermost Server to versions 8.1.1, 7.8.10 or higher.


source: advisory: MMSA-2023-00223
defect: https://mattermost.atlassian.net/browse/MM-53368
discovery: EXTERNAL
title: A system/user manager can demote / deactivate another manager
x_generator: engine: Vulnogram 0.1.0-dev