Vulnerability-Lookup

CVE-2023-4107 (GCVE-0-2023-4107)

Vulnerability from cvelistv5 – Published: 2023-08-11 06:12 – Updated: 2024-10-11 16:52

Title

Incorrect authorization allows a user manager to update a system admin

Summary

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-11 16:50 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

Mattermost mitre root

References

1 reference

URL	Tags
https://mattermost.com/security-updates

Impacted products

2 products

Vendor	Product	Version	CPE status
Mattermost	Mattermost	Affected: 0 , ≤ 7.8.7 (semver) Affected: 0 , ≤ 7.9.5 (semver) Affected: 0 , ≤ 7.10.3 (semver) Unaffected: 7.8.8 Unaffected: 7.9.6 Unaffected: 7.10.4	guessed
mattermost	mattermost	Affected: 7.8.0 , < 7.8.8 (custom) Affected: 7.9.0 , < 7.9.6 (custom) Affected: 7.10.0 , < 7.10.4 (custom) cpe:2.3:a:mattermost:mattermost::::::::

Credits

Pyae Phyo (pyae_phyo)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:17:12.064Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://mattermost.com/security-updates"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mattermost",
            "vendor": "mattermost",
            "versions": [
              {
                "lessThan": "7.8.8",
                "status": "affected",
                "version": "7.8.0",
                "versionType": "custom"
              },
              {
                "lessThan": "7.9.6",
                "status": "affected",
                "version": "7.9.0",
                "versionType": "custom"
              },
              {
                "lessThan": "7.10.4",
                "status": "affected",
                "version": "7.10.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-4107",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-11T16:50:49.740745Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-11T16:52:17.516Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "7.8.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.9.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.10.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.8.8"
            },
            {
              "status": "unaffected",
              "version": "7.9.6"
            },
            {
              "status": "unaffected",
              "version": "7.10.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Pyae Phyo (pyae_phyo)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\u003c/p\u003e"
            }
          ],
          "value": "Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-11T06:12:21.977Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate Mattermost Server to versions 7.8.8, 7.9.6,\u0026nbsp;7.10.4 or higher.\u003c/p\u003e"
            }
          ],
          "value": "Update Mattermost Server to versions 7.8.8, 7.9.6,\u00a07.10.4 or higher.\n\n"
        }
      ],
      "source": {
        "advisory": "MMSA-2023-00207",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-53091"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Incorrect authorization allows a user manager to update a system admin",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2023-4107",
    "datePublished": "2023-08-11T06:12:21.977Z",
    "dateReserved": "2023-08-02T15:27:32.294Z",
    "dateUpdated": "2024-10-11T16:52:17.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-4107",
      "date": "2026-09-17",
      "epss": "0.00508",
      "percentile": "0.42228"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.8.0\", \"versionEndExcluding\": \"7.8.8\", \"matchCriteriaId\": \"DD009FA6-13F6-4278-BFD6-FEF7EB0CBE76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.9.0\", \"versionEndExcluding\": \"7.9.6\", \"matchCriteriaId\": \"48DD3C64-F6CE-486D-8AAF-DFB842C458A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.10.0\", \"versionEndExcluding\": \"7.10.4\", \"matchCriteriaId\": \"2033E504-EE27-49CC-8E76-5776450E1CD6\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"Mattermost no valida correctamente los permisos de usuario solicitados al actualizar un administrador del sistema, lo que permite a un administrador de usuarios actualizar los datos de un administrador del sistema, como el correo electr\\u00f3nico, el nombre y los apellidos.\"}]",
      "id": "CVE-2023-4107",
      "lastModified": "2024-11-21T08:34:24.487",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"responsibledisclosure@mattermost.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L\", \"baseScore\": 6.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.5}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2023-08-11T07:15:09.963",
      "references": "[{\"url\": \"https://mattermost.com/security-updates\", \"source\": \"responsibledisclosure@mattermost.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://mattermost.com/security-updates\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "responsibledisclosure@mattermost.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"responsibledisclosure@mattermost.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-863\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-863\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-4107\",\"sourceIdentifier\":\"responsibledisclosure@mattermost.com\",\"published\":\"2023-08-11T07:15:09.963\",\"lastModified\":\"2026-06-17T06:37:05.797\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\\n\\n\"},{\"lang\":\"es\",\"value\":\"Mattermost no valida correctamente los permisos de usuario solicitados al actualizar un administrador del sistema, lo que permite a un administrador de usuarios actualizar los datos de un administrador del sistema, como el correo electr\u00f3nico, el nombre y los apellidos.\"}],\"affected\":[{\"source\":\"responsibledisclosure@mattermost.com\",\"affectedData\":[{\"vendor\":\"Mattermost\",\"product\":\"Mattermost\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"7.8.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThanOrEqual\":\"7.9.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThanOrEqual\":\"7.10.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.8.8\",\"status\":\"unaffected\"},{\"version\":\"7.9.6\",\"status\":\"unaffected\"},{\"version\":\"7.10.4\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"mattermost\",\"product\":\"mattermost\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"7.8.0\",\"lessThan\":\"7.8.8\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7.9.0\",\"lessThan\":\"7.9.6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7.10.0\",\"lessThan\":\"7.10.4\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"responsibledisclosure@mattermost.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":6.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.2,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-11T16:50:49.740745Z\",\"id\":\"CVE-2023-4107\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"responsibledisclosure@mattermost.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.8.0\",\"versionEndExcluding\":\"7.8.8\",\"matchCriteriaId\":\"DD009FA6-13F6-4278-BFD6-FEF7EB0CBE76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.9.0\",\"versionEndExcluding\":\"7.9.6\",\"matchCriteriaId\":\"48DD3C64-F6CE-486D-8AAF-DFB842C458A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.10.0\",\"versionEndExcluding\":\"7.10.4\",\"matchCriteriaId\":\"2033E504-EE27-49CC-8E76-5776450E1CD6\"}]}]}],\"references\":[{\"url\":\"https://mattermost.com/security-updates\",\"source\":\"responsibledisclosure@mattermost.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://mattermost.com/security-updates\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://mattermost.com/security-updates\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T07:17:12.064Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-4107\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-11T16:50:49.740745Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*\"], \"vendor\": \"mattermost\", \"product\": \"mattermost\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.8.0\", \"lessThan\": \"7.8.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.9.0\", \"lessThan\": \"7.9.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.10.0\", \"lessThan\": \"7.10.4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-11T16:52:11.959Z\"}}], \"cna\": {\"title\": \"Incorrect authorization allows a user manager to update a system admin\", \"source\": {\"defect\": [\"https://mattermost.atlassian.net/browse/MM-53091\"], \"advisory\": \"MMSA-2023-00207\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Pyae Phyo (pyae_phyo)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Mattermost\", \"product\": \"Mattermost\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.8.7\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.9.5\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.10.3\"}, {\"status\": \"unaffected\", \"version\": \"7.8.8\"}, {\"status\": \"unaffected\", \"version\": \"7.9.6\"}, {\"status\": \"unaffected\", \"version\": \"7.10.4\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update Mattermost Server to versions 7.8.8, 7.9.6,\\u00a07.10.4 or higher.\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eUpdate Mattermost Server to versions 7.8.8, 7.9.6,\u0026nbsp;7.10.4 or higher.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://mattermost.com/security-updates\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee\", \"shortName\": \"Mattermost\", \"dateUpdated\": \"2023-08-11T06:12:21.977Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-4107\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-11T16:52:17.516Z\", \"dateReserved\": \"2023-08-02T15:27:32.294Z\", \"assignerOrgId\": \"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee\", \"datePublished\": \"2023-08-11T06:12:21.977Z\", \"assignerShortName\": \"Mattermost\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2023-4107

Vulnerability from fkie_nvd - Published: 2023-08-11 07:15 - Updated: 2026-06-17 06:37

Severity

6.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

References

	URL	Tags
	responsibledisclosure@mattermost.com	https://mattermost.com/security-updates	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://mattermost.com/security-updates	Vendor Advisory

Impacted products

Vendor	Product	Version
mattermost	mattermost	*
mattermost	mattermost	*
mattermost	mattermost	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "7.8.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.9.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.10.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.8.8"
            },
            {
              "status": "unaffected",
              "version": "7.9.6"
            },
            {
              "status": "unaffected",
              "version": "7.10.4"
            }
          ]
        }
      ],
      "source": "responsibledisclosure@mattermost.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "mattermost",
          "vendor": "mattermost",
          "versions": [
            {
              "lessThan": "7.8.8",
              "status": "affected",
              "version": "7.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.9.6",
              "status": "affected",
              "version": "7.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.10.4",
              "status": "affected",
              "version": "7.10.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD009FA6-13F6-4278-BFD6-FEF7EB0CBE76",
              "versionEndExcluding": "7.8.8",
              "versionStartIncluding": "7.8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "48DD3C64-F6CE-486D-8AAF-DFB842C458A6",
              "versionEndExcluding": "7.9.6",
              "versionStartIncluding": "7.9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2033E504-EE27-49CC-8E76-5776450E1CD6",
              "versionEndExcluding": "7.10.4",
              "versionStartIncluding": "7.10.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\n\n"
    },
    {
      "lang": "es",
      "value": "Mattermost no valida correctamente los permisos de usuario solicitados al actualizar un administrador del sistema, lo que permite a un administrador de usuarios actualizar los datos de un administrador del sistema, como el correo electr\u00f3nico, el nombre y los apellidos."
    }
  ],
  "id": "CVE-2023-4107",
  "lastModified": "2026-06-17T06:37:05.797",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.5,
        "source": "responsibledisclosure@mattermost.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-4107",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-11T16:50:49.740745Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-08-11T07:15:09.963",
  "references": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://mattermost.com/security-updates"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "responsibledisclosure@mattermost.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-6XJJ-V76V-FWPJ

Vulnerability from github – Published: 2023-08-11 09:30 – Updated: 2023-08-11 21:56

Summary

Mattermost does not validate requesting user permissions before updating admin details

Details

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

Severity

6.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.8.7"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server/v6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.8.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.9.5"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server/v6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.9.0"
            },
            {
              "fixed": "7.9.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.10.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server/v6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.10.0"
            },
            {
              "fixed": "7.10.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-4107"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-11T21:56:52Z",
    "nvd_published_at": "2023-08-11T07:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\n\n",
  "id": "GHSA-6xjj-v76v-fwpj",
  "modified": "2023-08-11T21:56:52Z",
  "published": "2023-08-11T09:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4107"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mattermost/mattermost"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mattermost does not validate requesting user permissions before updating admin details"
}

GSD-2023-4107

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

Aliases

CVE-2023-4107

Aliases

CVE-2023-4107

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-4107",
    "id": "GSD-2023-4107"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-4107"
      ],
      "details": "Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\n\n",
      "id": "GSD-2023-4107",
      "modified": "2023-12-13T01:20:26.957563Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "responsibledisclosure@mattermost.com",
        "ID": "CVE-2023-4107",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Mattermost",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThanOrEqual": "7.8.7",
                                "status": "affected",
                                "version": "0",
                                "versionType": "semver"
                              },
                              {
                                "lessThanOrEqual": "7.9.5",
                                "status": "affected",
                                "version": "0",
                                "versionType": "semver"
                              },
                              {
                                "lessThanOrEqual": "7.10.3",
                                "status": "affected",
                                "version": "0",
                                "versionType": "semver"
                              },
                              {
                                "status": "unaffected",
                                "version": "7.8.8"
                              },
                              {
                                "status": "unaffected",
                                "version": "7.9.6"
                              },
                              {
                                "status": "unaffected",
                                "version": "7.10.4"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Mattermost"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Pyae Phyo (pyae_phyo)"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-863",
                "lang": "eng",
                "value": "CWE-863 Incorrect Authorization"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://mattermost.com/security-updates",
            "refsource": "MISC",
            "url": "https://mattermost.com/security-updates"
          }
        ]
      },
      "solution": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate Mattermost Server to versions 7.8.8, 7.9.6,\u0026nbsp;7.10.4 or higher.\u003c/p\u003e"
            }
          ],
          "value": "Update Mattermost Server to versions 7.8.8, 7.9.6,\u00a07.10.4 or higher.\n\n"
        }
      ],
      "source": {
        "advisory": "MMSA-2023-00207",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-53091"
        ],
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.10.4",
                "versionStartIncluding": "7.10.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.9.6",
                "versionStartIncluding": "7.9.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.8.8",
                "versionStartIncluding": "7.8.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "responsibledisclosure@mattermost.com",
          "ID": "CVE-2023-4107"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin\u0027s details such as email, first name and last name.\n\n"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-863"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://mattermost.com/security-updates",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-08-15T20:19Z",
      "publishedDate": "2023-08-11T07:15Z"
    }
  }
}

WID-SEC-W-2023-1739

Vulnerability from csaf_certbund - Published: 2023-07-12 22:00 - Updated: 2023-08-10 22:00

Summary

Mattermost: Mehrere Schwachstellen

Severity

Mittel

Scope

4 vulnerabilities in this advisory, including CVE-2023-4107.

CVE-2023-4107

Es existieren mehrere Schwachstellen in Mattermost. Diese bestehen aufgrund ungenügender Überprüfungen von Berechtigungen und Eingaben und einer fehlerhaften Löschung von Anhängen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und einen Denial of Service zu verursachen.

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-4107 (GCVE-0-2023-4107)

FKIE_CVE-2023-4107

GHSA-6XJJ-V76V-FWPJ

GSD-2023-4107

WID-SEC-W-2023-1739

Tags

Sightings

Nomenclature

Related by attack behaviour