CVE-2024-29221

2024-04-0509:15:09

CWE-284

Mattermost

web.nvd.nist.gov

cve-2024-29221

mattermost server

access control

endpoint

team admin

invite id

nvd

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

AI Score

6.5

Confidence

Low

EPSS

Percentile

9.0%

JSON

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the “Add Members” permission was explicitly removed from team admins.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "9.5.1",
        "status": "affected",
        "version": "9.5.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.4.3",
        "status": "affected",
        "version": "9.4.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.3.2",
        "status": "affected",
        "version": "9.3.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.1.10",
        "status": "affected",
        "version": "8.1.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "9.6.0"
      },
      {
        "status": "unaffected",
        "version": "9.5.2"
      },
      {
        "status": "unaffected",
        "version": "9.4.4"
      },
      {
        "status": "unaffected",
        "version": "9.3.3"
      },
      {
        "status": "unaffected",
        "version": "8.1.11"
      }
    ]
  }
]