Lucene search

GoogleOSV:GHSA-9FPW-C9X7-CV3J

HistoryAug 01, 2024 - 3:32 p.m.

Mattermost allows remote actor to set arbitrary RemoteId values for synced users

2024-08-0115:32:23

Google

osv.dev

mattermost

remote actor

arbitrary remoteid

synced users

version 9.9.x

version 9.5.x

validate

sync messages

source

malicious remote

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

14.7%

JSON

Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.

References

github.com/mattermost/mattermost

mattermost.com/security-updates

nvd.nist.gov/vuln/detail/CVE-2024-41926

pkg.go.dev/vuln/GO-2024-3022

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

14.7%

JSON

Related for OSV:GHSA-9FPW-C9X7-CV3J