CVE-2023-4106: A guest user can perform various actions on public playbooks
Published Aug 11, 2023
·Updated
Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.
Affected Software
6 affected componentsFixes available
go/github.com/mattermost/mattermost-server/v6<=7.8.7
7.8.8
go/github.com/mattermost/mattermost-server/v6>=7.10.0<=7.10.3
7.10.4
go/github.com/mattermost/mattermost-server/v6>=7.9.0<=7.9.5
7.9.6
Mattermost Mattermost>=7.8.0<7.8.8
Mattermost Mattermost>=7.9.0<7.9.6
Mattermost Mattermost>=7.10.0<7.10.4
Remediation
Information
Update Mattermost Server to versions 7.8.8, 7.9.5, 7.10.4 or higher. Otherwise, update the Playbooks plugin to version v1.37.0 or higher.
Event History
Aug 11, 2023
CVE Published
via MITRE·06:12 AM
Data Sourced
via MITRE·06:12 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
09:30 AM
Frequently Asked Questions
1
What is CVE-2023-4106?
CVE-2023-4106 is a vulnerability in Mattermost that allows a guest user to perform unauthorized actions on public playbooks.
2
How severe is CVE-2023-4106?
CVE-2023-4106 is rated as medium severity with a CVSS score of 6.3.
3
Which software versions are affected by CVE-2023-4106?
Affected versions of Mattermost include 7.8.0 to 7.8.8, 7.9.0 to 7.9.6, and 7.10.0 to 7.10.4.
4
How can a guest user exploit CVE-2023-4106?
A guest user can exploit CVE-2023-4106 to view, join, edit, export, and archive public playbooks in Mattermost.
5
How can CVE-2023-4106 be fixed?
To fix CVE-2023-4106, upgrade Mattermost to version 7.8.9, 7.9.7, or 7.10.5.