CVE-2023-3587

Summary

Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost0 <= 7.8.6affected
MattermostMattermost0 <= 7.9.4affected
MattermostMattermost0 <= 7.10.2affected
MattermostMattermost7.8.7unaffected
MattermostMattermost7.9.5unaffected
MattermostMattermost7.10.3unaffected

Weaknesses

  • CWE-862: CWE-862 Missing Authorization

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References