CVE-2023-45316CWE-352

Reflected client side path traversal leading to CSRF in Playbooks

High · published December 12, 2023

CVSS v3.1
7.3
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.8th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2023-12-12T08:23Z
EPSS history
Timeline
  • 12 DEC 08:23Z
    Reflected client side path traversal leading to CSRF in Playbooks
    cvelistv5