CVE-2023-2791

Summary

When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost0 < 7.9.2affected
MattermostMattermost0 < 7.8.3affected
MattermostMattermost0 < 7.7.4affected
MattermostMattermost0 < 7.10.1affected
MattermostMattermost7.9.2unaffected
MattermostMattermost7.8.3unaffected
MattermostMattermost7.7.4unaffected
MattermostMattermost7.10.1unaffected

Weaknesses

  • CWE-862: CWE-862 Missing Authorization

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References