Lucene search

MattermostCVE-2024-39353

HistoryJul 03, 2024 - 9:15 a.m.

CVE-2024-39353

2024-07-0309:15:06

CWE-200

Mattermost

web.nvd.nist.gov

cve-2024-39353

mattermost

remoteclusterframe

audit logging

vulnerability

version 9.5.x

version 9.8.0

high privileged attacker

message contents

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

AI Score

3.5

Confidence

High

EPSS

Percentile

14.2%

JSON

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker with access to the audit logs to read message contents.

Affected configurations

Nvd

Node

mattermostmattermostRange9.5.0–9.5.6

mattermostmattermostMatch9.8.0

VendorProductVersionCPE
mattermostmattermost*cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*
mattermostmattermost9.8.0cpe:2.3:a:mattermost:mattermost:9.8.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mattermost	mattermost	*	cpe:2.3:a:mattermost:mattermost::::::::
mattermost	mattermost	9.8.0	cpe:2.3:a:mattermost:mattermost:9.8.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "status": "affected",
        "version": "9.8.0"
      },
      {
        "lessThanOrEqual": "9.5.5",
        "status": "affected",
        "version": "9.5.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "9.9.0"
      },
      {
        "status": "unaffected",
        "version": "9.8.1"
      },
      {
        "status": "unaffected",
        "version": "9.5.6"
      }
    ]
  }
]

References

mattermost.com/security-updates

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

AI Score

3.5

Confidence

High

EPSS

Percentile

14.2%

JSON

Related for CVE-2024-39353