Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Weak cache keys lead to post IDOR and link preview poisoning
Vulnerability Description
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vulnerability Type
可逆的单向哈希
Vulnerability Title
Mattermost 安全漏洞
Vulnerability Description
Mattermost是美国Mattermost公司的一个开源协作平台。 Mattermost存在安全漏洞，该漏洞源于未正确验证链接元数据的缓存键，可能导致经过身份验证的用户通过FNV-1哈希冲突攻击访问未经授权的帖子和毒化链接预览。以下版本受到影响：10.8.3及之前的10.8.x版本、10.5.8及之前的10.5.x版本、9.11.17及之前的9.11.x版本、10.10.1及之前的10.10.x版本和10.9.3及之前的10.9.x版本。
CVSS Information
N/A
Vulnerability Type
N/A