CVE-2024-12247 — Incorrect Authorization in Server

CWE-863 — Incorrect AuthorizationCWE-362 — Race Condition4 documents4 sources
Severity
4.3MEDIUMNVD
CNA4.6
EPSS
0.1%
top 75.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mattermost ServerMattermost
Timeline
PublishedDec 5

Description

Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDmattermost/mattermost_server9.7.0 — 9.7.6+2
▶CVEListV5mattermost/mattermost9.7.0 — 9.7.5+2

🔴Vulnerability Details

2
GHSA
GHSA-8chw-qpp9-9385: Mattermost versions 9↗2024-12-05
▶
CVEList
Improper propagation of permission scheme updates across cluster nodes↗2024-12-05
▶
CVE-2024-12247 — Incorrect Authorization in Server | cvebase