What is GHSA-5qx9-9ffj-5r8f?

GHSA-5qx9-9ffj-5r8f is a security advisory published by GitHub Security Advisories with Low severity. Mattermost fails to fully validate role changes

Which CVE IDs does GHSA-5qx9-9ffj-5r8f cover?

GHSA-5qx9-9ffj-5r8f covers the following CVE IDs: CVE-2024-4198. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5qx9-9ffj-5r8f?

GHSA-5qx9-9ffj-5r8f has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

Which products are affected by GHSA-5qx9-9ffj-5r8f?

GHSA-5qx9-9ffj-5r8f affects 3 products, including: go/github.com/mattermost/mattermost-server:\u003e= 9.6.0-rc1, \u003c= 9.6.0; go/github.com/mattermost/mattermost-server:\u003e= 9.5.0, \u003c= 9.5.2; go/github.com/mattermost/mattermost-server:\u003e= 8.1.0, \u003c= 8.1.11.

GHSA-5qx9-9ffj-5r8fLowCVSS 2.7

Mattermost fails to fully validate role changes

Vendor

GitHub Security Advisories

Published

April 26, 2024

Last Modified

April 26, 2024

🔗 CVE IDs covered (1)

CVE-2024-4198 →

📋 Description

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.

🎯 Affected products3

go/github.com/mattermost/mattermost-server:>= 9.6.0-rc1, <= 9.6.0
go/github.com/mattermost/mattermost-server:>= 9.5.0, <= 9.5.2
go/github.com/mattermost/mattermost-server:>= 8.1.0, <= 8.1.11

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2024-4198
https://mattermost.com/security-updates
https://github.com/mattermost/mattermost/commit/3d6d8a7c1f7105558fe266a1b379859a4dba4e9b
https://github.com/mattermost/mattermost/commit/408ce4a82bb55ce27801f7044d9b3b49e82c47ed
https://github.com/mattermost/mattermost/commit/fba5b8e348feada9b21290369c3598ccd5c04424
https://github.com/advisories/GHSA-5qx9-9ffj-5r8f