CVE-2023-6727
Leak Inaccessible Playbook Information via Channel Action IDOR
Résumé
Leak Inaccessible Playbook Information via Channel Action IDOR
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, like the name, can be leaked.
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com