CVE-2023-45316
HIGH8.8EPSS 0.26%Published: 3/6/2024Modified: 4/3/2025
Description
Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack.
Affected packages (1)
- Bitnami/mattermostfrom 0, < 7.8.15, >= 8.0.0, < 8.1.6, >= 9.0.0, < 9.0.4, >= 9.1.1, < 9.1.3, >= 9.2.0, < 9.2.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |