CVE-2018-21261: Medium severity mattermost vulnerability
Published Jun 19, 2020
·Updated
An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team inviteid, which leads to unintended excessive invitation privileges.
Affected Software
3 affected components
Mattermost Mattermost Server>=4.6.0<4.6.3
Mattermost Mattermost Server>=4.7.0<4.7.4
Mattermost Mattermost Server>=4.8.0<4.8.1
Event History
Jun 19, 2020
CVE Published
via MITRE·04:51 PM
Data Sourced
via MITRE·04:51 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-21261?
CVE-2018-21261 has been rated as a medium severity vulnerability due to the risk of excessive invitation privileges.
2
How do I fix CVE-2018-21261?
To fix CVE-2018-21261, update your Mattermost Server to version 4.8.1 or later, or to versions 4.7.4 and 4.6.3.
3
What are the consequences of CVE-2018-21261?
The consequences of CVE-2018-21261 include unintended excessive invitation privileges that may lead to unauthorized access.
4
Which versions of Mattermost Server are affected by CVE-2018-21261?
CVE-2018-21261 affects Mattermost Server versions prior to 4.6.3, 4.7.4, and 4.8.1.
5
Is there a workaround for CVE-2018-21261?
There is no official workaround for CVE-2018-21261; upgrading to the latest version is the recommended solution.