CVE-2023-2784 — Apps Framework allows install requests from regular members via an internal path

CVE-2023-2784

Apps Framework allows install requests from regular members via an internal path PUBLISHED

Description (CNA)

Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests to the Apps.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost App Framework	affected 0 through 7.8.4; affected 0 through 7.9.3; affected 7.10.0; unaffected v7.8.5; unaffected v7.9.4; unaffected v7.10.1

CWE

CWE-862

References

https://mattermost.com/security-updates

ADP enrichment

CVE

No English description supplied.

https://mattermost.com/security-updates

CISA-ADP

No English description supplied.

No references supplied.