« Volver al listado

CVE-2018-21251

Estado: ModificadaCrítica (9.8)—

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mattermost — Mattermost Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-21251",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-19T17:15:12.490",
  "references": [
    {
      "url": "https://mattermost.com/security-updates/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://mattermost.com/security-updates/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en Mattermost Server versiones anteriores a 5.2 y 5.1.1. La autorización podría ser omitida si el nombre del canal no fuera el mismo en los parámetros y en el cuerpo"
    }
  ],
  "lastModified": "2026-06-17T01:54:28.367",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "502A1D2D-28B3-487C-8AD4-33555F3E5662",
              "versionEndExcluding": "5.1.1"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4278AE6D-09CF-4E82-B728-EDD1DFD6C4D0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "094E718B-6916-4473-A289-5CA8A1291969"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6188A07E-A8A2-4573-9882-7FEF4316D688"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D223D23-FE0B-44A5-AEC3-F6935AFFBC0D"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3807BAF-FEE4-4A35-8CDA-E3BE991BC117"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5821F28D-E507-446F-98CF-9284A588E8CA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}