Skip to main content

Incorrect Permission Assignment for Critical Resource

CVE-2017-18916

Medium
5.3/10

Summary

An issue was discovered in Mattermost Server versions prior to 3.6.7, 3.7.x prior to 3.7.5, and 3.8.x prior to 3.8.0. API endpoint access control does not honor an integration permission restriction.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-732 - Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References

Advisory Timeline

  • Published