description: Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.
problem types: CWE-284: Improper Access Control
affected:
{
defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 9.5.1, status: affected, version: 9.5.0, versionType: semver
lessThanOrEqual: 9.4.3, status: affected, version: 9.4.0, versionType: semver
lessThanOrEqual: 9.3.2, status: affected, version: 9.3.0, versionType: semver
lessThanOrEqual: 8.1.10, status: affected, version: 8.1.0, versionType: semver
status: unaffected, version: 9.6.0
status: unaffected, version: 9.5.2
status: unaffected, version: 9.4.4
status: unaffected, version: 9.3.3
status: unaffected, version: 8.1.11
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Mattermost Server to versions 9.6.0, 9.5.2, 9.4.4, 9.3.3, 8.1.11 or higher.