2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mattermost","vendor":"Mattermost","versions":[{"lessThanOrEqual":"10.5.3","status":"affected","version":"10.5.0","versionType":"semver"},{"lessThanOrEqual":"9.11.12","status":"affected","version":"9.11.0","versionType":"semver"},{"status":"unaffected","version":"10.8.0"},{"status":"unaffected","version":"10.5.4"},{"status":"unaffected","version":"9.11.13"}]}],"source":"responsibledisclosure@mattermost.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"BC431F02-E096-4994-9CB3-AC2DB1C7FAB5","versionEndExcluding":"9.11.13","versionStartIncluding":"9.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"6EB2F235-4072-4E5E-914C-07829E12A481","versionEndExcluding":"10.5.4","versionStartIncluding":"10.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"9A7C1EB8-01C3-4449-A3D2-3C25B4334032","versionEndExcluding":"10.7.1","versionStartIncluding":"10.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint."},{"lang":"es","value":"Las versiones de Mattermost 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 no implementan correctamente los controles de acceso para los usuarios invitados que acceden a la información de los miembros del canal, lo que permite que los usuarios invitados autenticados vean metadatos sobre los miembros de los canales públicos a través del endpoint de la API de miembros del canal."}],"id":"CVE-2025-1792","lastModified":"2026-06-17T08:39:47.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"responsibledisclosure@mattermost.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-1792","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-30T14:46:35.551696Z","version":"2.0.3"}}]},"published":"2025-05-30T15:15:40.553","references":[{"source":"responsibledisclosure@mattermost.com","tags":["Vendor Advisory"],"url":"https://mattermost.com/security-updates"}],"sourceIdentifier":"responsibledisclosure@mattermost.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"responsibledisclosure@mattermost.com","type":"Secondary"}]}
|