SB2020061935 - Multiple vulnerabilities in Mattermost, Mattermost Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020061935

SB2020061935 - Multiple vulnerabilities in Mattermost, Mattermost Server

Published: June 19, 2020 Updated: July 17, 2020

Security Bulletin ID SB2020061935
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Incorrect permission assignment for critical resource (CVE-ID: CVE-2018-21252)

The vulnerability allows a remote authenticated user to manipulate data.

An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups.


2) Missing Authorization (CVE-ID: CVE-2018-21251)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.


Remediation

Install update from vendor's website.

References