MEDIUM
Playbook run link to private channel grants channel access
Published May 26, 2024
5.9
MEDIUMCVSS 3.1
EPSS 0.23%
Description
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of.
Affected products
-
- Version 8.1.0StatusaffectedConstraints<=8.1.12
- Version 9.5.0StatusaffectedConstraints<=9.5.3
- Version 9.6.0StatusaffectedConstraints<=9.6.1
- Version 8.1.13StatusunaffectedConstraints-
- Version 9.5.4StatusunaffectedConstraints-
- Version 9.6.2StatusunaffectedConstraints-
- Version 9.7.0StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mattermost | Mattermost | unaffected |
|
OR
- ≥ 8.1.0 · < 8.1.13
- ≥ 9.5.0 · < 9.5.4
- ≥ 9.6.0 · < 9.6.2
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher.
Weaknesses (2)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-34458 Advisory
- https://mattermost.com/security-updates Vendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-34458 | Advisory | |
| https://mattermost.com/security-updates | Vendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Mattermost
Published May 26, 2024
Updated Aug 2, 2024
Reserved May 23, 2024
Link CVE-2024-32045
CISA Vulnrichment
Updated Jun 7, 2024
ENISA EUVD
EUVD-2024-34458 Assigner Mattermost
Published May 26, 2024
Updated Aug 2, 2024
Exploited since n/a
Link EUVD-2024-34458