CVE-2023-45316 — Reflected client side path traversal leading to CSRF in Playbooks
Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path tra…
Published: 2023-12-12 · CVSS: 7.3 · CVSS 3.1
Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7