SB2020061931 - Multiple vulnerabilities in Mattermost, Mattermost Server
Published: June 19, 2020 Updated: July 17, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 18 secuirty vulnerabilities.
1) Path traversal (CVE-ID: CVE-2017-18874)
The vulnerability allows a remote privileged user to read and manipulate data.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.
2) Incorrect permission assignment for critical resource (CVE-ID: CVE-2017-18878)
The vulnerability allows a remote authenticated user to perform service disruption.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
3) Cross-site scripting (CVE-ID: CVE-2017-18879)
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via the author_link field of a Slack attachment. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Cross-site scripting (CVE-ID: CVE-2017-18880)
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via the title_link field of a Slack attachment. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
5) Cross-site scripting (CVE-ID: CVE-2017-18881)
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via a goto_location response to a slash command. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
6) Cross-site scripting (CVE-ID: CVE-2017-18882)
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via OpenGraph data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
7) Insufficient Entropy (CVE-ID: CVE-2017-18883)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
8) Improper Privilege Management (CVE-ID: CVE-2017-18884)
The vulnerability allows a remote authenticated user to read and manipulate data.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
9) Improper Privilege Management (CVE-ID: CVE-2017-18885)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.
10) Incorrect permission assignment for critical resource (CVE-ID: CVE-2017-18886)
The vulnerability allows a remote authenticated user to execute arbitrary code.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.
11) Information disclosure (CVE-ID: CVE-2017-18887)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
12) SQL injection (CVE-ID: CVE-2017-18888)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data during the fetching of multiple posts in An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
13) Input validation error (CVE-ID: CVE-2017-18889)
The vulnerability allows a remote authenticated user to manipulate data.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API.
14) Input validation error (CVE-ID: CVE-2017-18890)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request.
15) Input validation error (CVE-ID: CVE-2017-18873)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post.
16) Incorrect permission assignment for critical resource (CVE-ID: CVE-2017-18875)
The vulnerability allows a remote privileged user to manipulate data.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.
17) Incorrect permission assignment for critical resource (CVE-ID: CVE-2017-18876)
The vulnerability allows a remote privileged user to gain access to sensitive information.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
18) Cross-site scripting (CVE-ID: CVE-2017-18877)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.
Remediation
Install update from vendor's website.