Lucene search
HistoryMay 26, 2024 - 2:15 p.m.
CVE-2024-36241
nvd
cve-2024-36241
mattermost
access controls
arbitrary post contents
CVSS3
3.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
AI Score
4.2
Confidence
High
EPSS
0
Percentile
9.0%
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents via the /playbook add slash command
References
Related
veracode
veracode
Improper Access Control
2024-05-28 10:01:38
cve
cve
CVE-2024-36241
2024-05-26 14:15:09
vulnrichment
vulnrichment
cvelist
cvelist
CVSS3
3.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
AI Score
4.2
Confidence
High
EPSS
0
Percentile
9.0%
Related for NVD:CVE-2024-36241