ByteOS Network

NVD Vulnerability Details :

CVE-2024-39274

Analyzed

Source-responsibledisclosure@mattermost.com

Published At-01 Aug, 2024 | 15:15

Updated At-23 Aug, 2024 | 14:39

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add users to arbitrary teams and channels

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Secondary	3.1	8.7	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CPE Matches

Mattermost, Inc.

>>mattermost>>Versions from 9.5.0(inclusive) to 9.5.7(exclusive)

cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*

Mattermost, Inc.

>>mattermost>>Versions from 9.7.0(inclusive) to 9.7.6(exclusive)

cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*

Mattermost, Inc.

>>mattermost>>Versions from 9.8.0(inclusive) to 9.8.2(exclusive)

cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*

Mattermost, Inc.

>>mattermost>>9.9.0

cpe:2.3:a:mattermost:mattermost:9.9.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-284	Secondary	responsibledisclosure@mattermost.com

References

Hyperlink	Source	Resource
https://mattermost.com/security-updates	responsibledisclosure@mattermost.com	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History