← CVE Intelligence

CVE-2023-45316

Reflected client side path traversal leading to CSRF in Playbooks PUBLISHED

Description (CNA)

Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack.

Affected (CNA)

Vendor / productVersions
Mattermost / Mattermostaffected 0 through 9.1.2; affected 0 through 9.0.3; affected 0 through 8.1.5; affected 0 through 7.8.14; affected 0 through 9.2.1; unaffected 8.1.6; unaffected 9.0.4; unaffected 9.1.3; unaffected 9.2.2; unaffected 7.8.15

CWE

CWE-352

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.