CVE-2024-8071 - System Role with edit access to permissions can elevate themselves to system admin

Back Back to CVE browser

MEDIUM

System Role with edit access to permissions can elevate themselves to system admin

Published Aug 22, 2024

5.1

MEDIUM

CVSS 4.0

EPSS 0.34%

Description

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin.

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
- Version
  9.10.0
  Status
  affected
  Constraints
  -
- Version
  9.5.0
  Status
  affected
  Constraints
  <=9.5.7
- Version
  9.8.0
  Status
  affected
  Constraints
  <=9.8.2
- Version
  9.9.0
  Status
  affected
  Constraints
  <=9.9.1
- Version
  9.10.1
  Status
  unaffected
  Constraints
  -
- Version
  9.11.0
  Status
  unaffected
  Constraints
  -
- Version
  9.5.8
  Status
  unaffected
  Constraints
  -
- Version
  9.8.3
  Status
  unaffected
  Constraints
  -
- Version
  9.9.2
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mattermost

unaffected

Version	Status	Constraints
9.10.0	affected	-
9.5.0	affected	<=9.5.7
9.8.0	affected	<=9.8.2
9.9.0	affected	<=9.9.1
9.10.1	unaffected	-
9.11.0	unaffected	-
9.5.8	unaffected	-
9.8.3	unaffected	-
9.9.2	unaffected	-

github.com/mattermost/mattermost-server

Go

Introduced 9.5.0+incompatible Fixed 9.5.8+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 9.8.0+incompatible Fixed 9.8.3+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 9.9.0+incompatible Fixed 9.9.2+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 9.10.0+incompatible Fixed 9.10.1+incompatible
github.com/mattermost/mattermost-server/v5

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server/v6

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost/server/v8

Go

Introduced 0 Fixed not fixed

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost-server	9.5.0+incompatible	9.5.8+incompatible
Go	github.com/mattermost/mattermost-server	9.8.0+incompatible	9.8.3+incompatible
Go	github.com/mattermost/mattermost-server	9.9.0+incompatible	9.9.2+incompatible
Go	github.com/mattermost/mattermost-server	9.10.0+incompatible	9.10.1+incompatible
Go	github.com/mattermost/mattermost-server/v5	0	not fixed
Go	github.com/mattermost/mattermost-server/v6	0	not fixed
Go	github.com/mattermost/mattermost/server/v8	0	not fixed

Remediation

Vendor solution

Update Mattermost to versions 9.11.0, 9.9.2, 9.5.8, 9.10.1, 9.8.3 or higher.

Weaknesses (1)

CWE-284

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2499
Advisory
https://github.com/advisories/GHSA-5263-pm2h-m7hw
Advisory
https://mattermost.com/security-updates
Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-8071

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2499		Advisory
https://github.com/advisories/GHSA-5263-pm2h-m7hw		Advisory
https://mattermost.com/security-updates		Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-8071