description: Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to SAML authentication, allowing an authenticated attacker to take over other user accounts via a crafted switch request under specific conditions.
problem types: CWE-287: Improper Authentication
affected:
{
defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions:
status: affected, version: 9.5.0
lessThanOrEqual: 9.4.2, status: affected, version: 9.4.0, versionType: semver
lessThanOrEqual: 9.3.1, status: affected, version: 9.3.0, versionType: semver
lessThanOrEqual: 9.2.5, status: affected, version: 9.2.0, versionType: semver
lessThanOrEqual: 8.1.9, status: affected, version: 8.1.0, versionType: semver
status: unaffected, version: 9.6.0
status: unaffected, version: 9.4.3
status: unaffected, version: 9.5.1
status: unaffected, version: 9.3.2
status: unaffected, version: 9.2.6
status: unaffected, version: 8.1.10
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Mattermost Server to versions 9.6, 9.4.3, 9.5.1, 9.3.2, 9.2.6, 8.1.10 or higher.