Vulnerability · Published Nov 27, 2023 · Assigned by Mattermost
CVE-2023-47865Username and Icon override can be used by members when Hardened Mode is enabled
Medium 4.3
In plain English
A medium-severity improper access control in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the Hardened Mode setting was enabled
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server/v6 | 7.8.13 | GHSA-jj46-9cgh-qmfx |
| Go | github.com/mattermost/mattermost/server/v8 | 8.1.4 | GHSA-jj46-9cgh-qmfx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 0 – through 8.1.30 – through 7.8.12 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N