Lucene search

MattermostCVE-2024-32045

HistoryMay 26, 2024 - 2:15 p.m.

CVE-2024-32045

2024-05-2614:15:09

CWE-284

Mattermost

web.nvd.nist.gov

mattermost

access control

playbook linking

vulnerability

channel

team membership

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

JSON

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "9.5.3",
        "status": "affected",
        "version": "9.5.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.6.1",
        "status": "affected",
        "version": "9.6.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.1.12",
        "status": "affected",
        "version": "8.1.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "9.7.0"
      },
      {
        "status": "unaffected",
        "version": "9.5.4"
      },
      {
        "status": "unaffected",
        "version": "9.6.2"
      },
      {
        "status": "unaffected",
        "version": "8.1.13"
      }
    ]
  }
]

References

mattermost.com/security-updates

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-32045