2 lines
3.4 KiB
JSON
2 lines
3.4 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mattermost","vendor":"Mattermost","versions":[{"lessThanOrEqual":"11.5.1","status":"affected","version":"11.5.0","versionType":"semver"},{"lessThanOrEqual":"10.11.13","status":"affected","version":"10.11.0","versionType":"semver"},{"status":"unaffected","version":"11.6.0"},{"status":"unaffected","version":"11.5.2"},{"status":"unaffected","version":"10.11.14"}]}],"source":"responsibledisclosure@mattermost.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"413D9405-79C3-4299-B0DC-40D9EE5CC717","versionEndExcluding":"10.11.14","versionStartIncluding":"10.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"726AD6AD-6C01-45BB-9115-B8209717A6D4","versionEndExcluding":"11.5.2","versionStartIncluding":"11.5.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints.. Mattermost Advisory ID: MMSA-2026-00631"},{"lang":"es","value":"Mattermost versiones 11.5.x menor o igual que 11.5.1, 10.11.x menor o igual que 10.11.13 no aplican el PostEditTimeLimit en campos de publicación que no son mensajes, lo que permite a un usuario autenticado modificar adjuntos de archivos de publicación, propiedades (props) y el estado de anclaje después de que la ventana de edición ha expirado a través de los endpoints de la API de parche y actualización de publicaciones. ID de Aviso de Mattermost: MMSA-2026-00631"}],"id":"CVE-2026-4053","lastModified":"2026-11-11T20:10:00.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"responsibledisclosure@mattermost.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4053","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-15T20:01:07.687385Z","version":"2.0.3"}}]},"published":"2026-05-15T19:17:04.670","references":[{"source":"responsibledisclosure@mattermost.com","tags":["Vendor Advisory"],"url":"https://mattermost.com/security-updates"}],"sourceIdentifier":"responsibledisclosure@mattermost.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"responsibledisclosure@mattermost.com","type":"Secondary"}]}
|