ByteOS Network

Vulnerability Details :

CVE-2017-18875

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-19 Jun, 2020 | 16:47

Updated At-05 Aug, 2024 | 21:37

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:19 Jun, 2020 | 16:47

Updated At:05 Aug, 2024 | 21:37

▼CVE Numbering Authority (CNA)

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://mattermost.com/security-updates/	x_refsource_CONFIRM

Hyperlink: https://mattermost.com/security-updates/

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://mattermost.com/security-updates/	x_refsource_CONFIRM x_transferred

Hyperlink: https://mattermost.com/security-updates/

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:19 Jun, 2020 | 17:15

Updated At:29 Jun, 2020 | 14:12

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 4.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Type: Primary

Version: 2.0

Base score: 4.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:N/I:P/A:N

CPE Matches

Mattermost, Inc.

>>mattermost_server>>Versions before 4.1.2(exclusive)

cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*

Mattermost, Inc.

>>mattermost_server>>Versions from 4.2.0(inclusive) to 4.2.1(exclusive)

cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*

Mattermost, Inc.

>>mattermost_server>>4.3.0

cpe:2.3:a:mattermost:mattermost_server:4.3.0:rc1:*:*:*:*:*:*

Mattermost, Inc.

>>mattermost_server>>4.3.0

cpe:2.3:a:mattermost:mattermost_server:4.3.0:rc2:*:*:*:*:*:*

Mattermost, Inc.

>>mattermost_server>>4.3.0

cpe:2.3:a:mattermost:mattermost_server:4.3.0:rc3:*:*:*:*:*:*

Mattermost, Inc.

>>mattermost_server>>4.3.0

cpe:2.3:a:mattermost:mattermost_server:4.3.0:rc4:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-732	Primary	nvd@nist.gov

CWE ID: CWE-732

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://mattermost.com/security-updates/	cve@mitre.org	Vendor Advisory

Hyperlink: https://mattermost.com/security-updates/

Source: cve@mitre.org

Resource:

Vendor Advisory

Similar CVEs

59Records found

CVE-2017-0884

Matching Score-4

Assigner-HackerOne

View Details

Matching Score-4

Assigner-HackerOne

CVSS Score-4.3||MEDIUM

EPSS-0.21% / 42.76%

7 Day CHG~0.00%

Published-05 Apr, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder. Note that this only affects folders and files that the adversary has at least read-only permissions for.

Vendor-Nextcloud GmbH

Product-nextcloud_server Nextcloud Server

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CWE ID-CWE-275

Not Available

CVE-2020-10513

Matching Score-4

Assigner-TWCERT/CC

View Details

Matching Score-4

Assigner-TWCERT/CC

CVSS Score-8.8||HIGH

EPSS-0.26% / 48.71%

7 Day CHG~0.00%

Published-15 Apr, 2020 | 06:20

Updated-17 Sep, 2024 | 00:10

iCatch DVR - Broken Access Control

The file management interface of iCatch DVR firmware before 20200103 contains broken access control which allows the attacker to remotely manipulate arbitrary file.

Vendor-icatchinc iCatch Inc.

Product-dvr_interface DVR firmware

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2019-18453

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.07% / 20.61%

7 Day CHG~0.00%

Published-26 Nov, 2019 | 16:35

Updated-05 Aug, 2024 | 01:54

An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions.

Vendor-n/a GitLab Inc.

Product-gitlab n/a

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2018-1420

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.15% / 36.73%

7 Day CHG~0.00%

Published-01 Oct, 2018 | 15:00

Updated-16 Sep, 2024 | 17:47

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fix (CF) installation. This can lead to security miss-configuration of the installation. IBM X-Force ID: 138950.

Vendor-IBM Corporation

Product-websphere_portal WebSphere Portal

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2019-4603

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.10% / 28.74%

7 Day CHG~0.00%

Published-08 Apr, 2020 | 14:05

Updated-17 Sep, 2024 | 00:37

IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they were created by another user. IBM X-Force ID: 168295.

Vendor-IBM Corporation

Product-rational_quality_manager Rational Quality Manager

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2015-9456

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.29% / 51.68%

7 Day CHG~0.00%

Published-07 Oct, 2019 | 14:27

Updated-06 Aug, 2024 | 08:51

The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.

Vendor-orbisius n/a

Product-child_theme_creator n/a

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2021-31929

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.15% / 36.49%

7 Day CHG~0.00%

Published-10 Jun, 2021 | 13:03

Updated-03 Aug, 2024 | 23:10

Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify loyalty campaigns and settings, such as fraud prevention, coupon groups, email templates, or referrals.

Vendor-annexcloud n/a

Product-loyalty_experience_platform n/a

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2019-19263

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 13.18%