What is GHSA-5fh7-7mw7-mmx5?

GHSA-5fh7-7mw7-mmx5 is a security advisory published by GitHub Security Advisories with Low severity. Mattermost allows team admins to promote guests to team admins

Which CVE IDs does GHSA-5fh7-7mw7-mmx5 cover?

GHSA-5fh7-7mw7-mmx5 covers the following CVE IDs: CVE-2024-4195. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5fh7-7mw7-mmx5?

GHSA-5fh7-7mw7-mmx5 has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

Which products are affected by GHSA-5fh7-7mw7-mmx5?

GHSA-5fh7-7mw7-mmx5 affects 2 products, including: go/github.com/mattermost/mattermost-server:\u003e= 9.5.0, \u003c= 9.5.2; go/github.com/mattermost/mattermost-server:\u003e= 8.1.0, \u003c= 8.1.11.

GHSA-5fh7-7mw7-mmx5LowCVSS 2.7

Mattermost allows team admins to promote guests to team admins

Vendor

GitHub Security Advisories

Published

April 26, 2024

Last Modified

April 26, 2024

🔗 CVE IDs covered (1)

CVE-2024-4195 →

📋 Description

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.

🎯 Affected products2

go/github.com/mattermost/mattermost-server:>= 9.5.0, <= 9.5.2
go/github.com/mattermost/mattermost-server:>= 8.1.0, <= 8.1.11

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-4195
https://mattermost.com/security-updates
https://github.com/mattermost/mattermost/commit/1e3497e0595bb4f9908c94dd9d4685d48556b7e8
https://github.com/mattermost/mattermost/commit/f0872dd4e4ba34f061aa6982a71c7c29532aac2e
https://github.com/advisories/GHSA-5fh7-7mw7-mmx5