CVE-2023-49874

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Dec 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-498774.3IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive CVE-2023-498784.3IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive informatioCVE-2023-49889.8A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?mCVE-2023-498807.5In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the mesCVE-2023-498818.8IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonatCVE-2023-498837.5IBM Transformation Extender Advanced 10.0.1 does not require that users should have strong passwords by default, which makes it easierCVE-2023-498869.8IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java deCVE-2023-498978.8An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. ICVE-2023-498987.2In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation paramCVE-2023-498999.8An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communicatiCVE-2023-49907.5Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files.CVE-2023-499009.8An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter comm
CVE-2023-49874: Medium severity, CVSS 4.3 | Vulnix