SB2020061953 - Multiple vulnerabilities in Mattermost, Mattermost Server
Published: June 19, 2020 Updated: August 8, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Incorrect permission assignment for critical resource (CVE-ID: CVE-2018-21256)
The vulnerability allows a remote authenticated user to manipulate data.
An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for group-message channel creation) via the Group message slash command.
2) Incorrect permission assignment for critical resource (CVE-ID: CVE-2018-21254)
The vulnerability allows a remote authenticated user to manipulate data.
An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash command.
3) Incorrect permission assignment for critical resource (CVE-ID: CVE-2018-21255)
The vulnerability allows a remote authenticated user to manipulate data.
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel.
4) Missing Authorization (CVE-ID: CVE-2018-21257)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel header) via the Channel header slash command API.
5) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2018-21258)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command.
Remediation
Install update from vendor's website.