netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-4ww8-fprq-cq34
GHSA-5263-pm2h-m7hw
GHSA-869f-px86-vj84
GHSA-c6vp-jjgv-38wj
GHSA-hrf9-rm95-fpf3
GHSA-4ww8-fprq-cq34
GHSA-5263-pm2h-m7hw
GHSA-c6vp-jjgv-38wj
GHSA-hrf9-rm95-fpf3
This commit is contained in:
advisory-database[bot]
2024-08-23 21:18:31 +00:00
parent 272bf82987
commit 7ab0f35bb3
9 changed files with 520 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/08/GHSA-4ww8-fprq-cq34/GHSA-4ww8-fprq-cq34.json
+123
View File
@@ -0,0 +1,123 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4ww8-fprq-cq34",
"modified": "2024-08-23T21:17:12Z",
"published": "2024-08-22T09:30:32Z",
"aliases": [
"CVE-2024-32939"
],
"summary": "Mattermost doesn't redact remote users' original email addresses",
"details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.9.0"
},
{
"fixed": "9.9.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.5.0"
},
{
"fixed": "9.5.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.10.0"
},
{
"fixed": "9.10.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.8.0"
},
{
"fixed": "9.8.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32939"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-312"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-08-23T21:17:12Z",
"nvd_published_at": "2024-08-22T07:15:03Z"
}
}
advisories/github-reviewed/2024/08/GHSA-5263-pm2h-m7hw/GHSA-5263-pm2h-m7hw.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5263-pm2h-m7hw",
"modified": "2024-08-23T21:17:18Z",
"published": "2024-08-22T09:30:32Z",
"aliases": [
"CVE-2024-8071"
],
"summary": "Mattermost doesn't restrict which roles can promote a user as system admin",
"details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.9.0"
},
{
"fixed": "9.9.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.5.0"
},
{
"fixed": "9.5.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.10.0"
},
{
"fixed": "9.10.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.8.0"
},
{
"fixed": "9.8.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8071"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-08-23T21:17:18Z",
"nvd_published_at": "2024-08-22T07:15:04Z"
}
}
advisories/unreviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json → advisories/github-reviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-869f-px86-vj84",
"modified": "2024-08-23T09:30:35Z",
"modified": "2024-08-23T21:17:09Z",
"published": "2024-08-23T09:30:35Z",
"aliases": [
"CVE-2024-43105"
],
"summary": "Mattermost Plugin Channel Export excessive resource consumption",
"details": "Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by running the /export command multiple times at once.",
"severity": [
{
@@ -14,13 +15,39 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-plugin-channel-export"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43105"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost-plugin-channel-export/commit/bb6da1f6bedd6cefe2276d6493b5541843c543a6"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost-plugin-channel-export"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
@@ -31,8 +58,8 @@
"CWE-400"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-08-23T21:17:09Z",
"nvd_published_at": "2024-08-23T08:15:04Z"
}
}
advisories/github-reviewed/2024/08/GHSA-c6vp-jjgv-38wj/GHSA-c6vp-jjgv-38wj.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c6vp-jjgv-38wj",
"modified": "2024-08-23T21:17:15Z",
"published": "2024-08-22T09:30:32Z",
"aliases": [
"CVE-2024-39836"
],
"summary": "Mattermost allows remote/synthetic users to create sessions, reset passwords",
"details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.9.0"
},
{
"fixed": "9.9.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.5.0"
},
{
"fixed": "9.5.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.10.0"
},
{
"fixed": "9.10.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.8.0"
},
{
"fixed": "9.8.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39836"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-693"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-08-23T21:17:15Z",
"nvd_published_at": "2024-08-22T07:15:03Z"
}
}
advisories/github-reviewed/2024/08/GHSA-hrf9-rm95-fpf3/GHSA-hrf9-rm95-fpf3.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hrf9-rm95-fpf3",
"modified": "2024-08-23T21:17:16Z",
"published": "2024-08-22T09:30:32Z",
"aliases": [
"CVE-2024-40886"
],
"summary": "Mattermost Cross-Site Request Forgery vulnerability",
"details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.9.0"
},
{
"fixed": "9.9.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.5.0"
},
{
"fixed": "9.5.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.10.0"
},
{
"fixed": "9.10.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.8.0"
},
{
"fixed": "9.8.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40886"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-08-23T21:17:16Z",
"nvd_published_at": "2024-08-22T07:15:04Z"
}
}
advisories/unreviewed/2024/08/GHSA-4ww8-fprq-cq34/GHSA-4ww8-fprq-cq34.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4ww8-fprq-cq34",
"modified": "2024-08-22T09:30:32Z",
"published": "2024-08-22T09:30:32Z",
"aliases": [
"CVE-2024-32939"
],
"details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server.\"",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32939"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-312"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T07:15:03Z"
}
}
advisories/unreviewed/2024/08/GHSA-5263-pm2h-m7hw/GHSA-5263-pm2h-m7hw.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5263-pm2h-m7hw",
"modified": "2024-08-22T09:30:32Z",
"published": "2024-08-22T09:30:32Z",
"aliases": [
"CVE-2024-8071"
],
"details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8071"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T07:15:04Z"
}
}
advisories/unreviewed/2024/08/GHSA-c6vp-jjgv-38wj/GHSA-c6vp-jjgv-38wj.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c6vp-jjgv-38wj",
"modified": "2024-08-23T18:33:00Z",
"published": "2024-08-22T09:30:32Z",
"aliases": [
"CVE-2024-39836"
],
"details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39836"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-693"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T07:15:03Z"
}
}
advisories/unreviewed/2024/08/GHSA-hrf9-rm95-fpf3/GHSA-hrf9-rm95-fpf3.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hrf9-rm95-fpf3",
"modified": "2024-08-23T18:33:00Z",
"published": "2024-08-22T09:30:32Z",
"aliases": [
"CVE-2024-40886"
],
"details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40886"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T07:15:04Z"
}
}