CVE-2024-5270
SAML to email switch possible when email signin is disabled
Résumé
SAML to email switch possible when email signin is disabled
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a user requests to switch from SAML to Email. This allows the user to switch their authentication mail from SAML to email and possibly edit personal details that were otherwise non-editable and provided by the SAML provider.
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com