Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.

Threat-Mapped Scoring

Score: 2.3

Priority: P3 - Important (Medium)

• S6 – Espionage of Financial Trades

EPSS

Score: 0.0039
Percentile: 0.59249

CVSS Scoring

Mapped CWE(s)

• CWE-200 : Exposure of Sensitive Information to an Unauthorized Actor

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1562.003 : Impair Command History Logging
  Kill Chain: defense-evasion
• T1574.006 : Dynamic Linker Hijacking
  Kill Chain: persistence
• T1574.007 : Path Interception by PATH Environment Variable
  Kill Chain: persistence
• T1217 : Browser Information Discovery
  Kill Chain: discovery
• T1592 : Gather Victim Host Information
  Kill Chain: reconnaissance
• T1595 : Active Scanning
  Kill Chain: reconnaissance
• T1018 : Remote System Discovery
  Kill Chain: discovery
• T1124 : System Time Discovery
  Kill Chain: discovery
• T1046 : Network Service Discovery
  Kill Chain: discovery
• T1016 : System Network Configuration Discovery
  Kill Chain: discovery
• T1049 : System Network Connections Discovery
  Kill Chain: discovery
• T1590 : Gather Victim Network Information
  Kill Chain: reconnaissance
• T1082 : System Information Discovery
  Kill Chain: discovery
• T1082 : System Information Discovery
  Kill Chain: discovery
• T1083 : File and Directory Discovery
  Kill Chain: discovery
• T1057 : Process Discovery
  Kill Chain: discovery
• T1007 : System Service Discovery
  Kill Chain: discovery
• T1087 : Account Discovery
  Kill Chain: discovery
• T1069 : Permission Groups Discovery
  Kill Chain: discovery
• T1615 : Group Policy Discovery
  Kill Chain: discovery
• T1033 : System Owner/User Discovery
  Kill Chain: discovery
• T1134.001 : Token Impersonation/Theft
  Kill Chain: defense-evasion
• T1550.004 : Web Session Cookie
  Kill Chain: defense-evasion
• T1036.005 : Match Legitimate Resource Name or Location
  Kill Chain: defense-evasion
• T1135 : Network Share Discovery
  Kill Chain: discovery
• T1120 : Peripheral Device Discovery
  Kill Chain: discovery
• T1111 : Multi-Factor Authentication Interception
  Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*

← Back to Home