CVE-2024-1942
published 2024-02-29CVE-2024-1942: Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions…
PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.36%
28.5th percentile
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 9.2.0+incompatible < 9.2.5+incompatible | 9.2.5+incompatible |
| github.com | mattermost_mattermost-server | >= 9.3.0+incompatible < 9.3.1+incompatible | 9.3.1+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.1.9 | 8.1.9 |
| github.com | mattermost_mattermost_server_v8 | >= 9.2.0 < 9.2.5 | 9.2.5 |
| github.com | mattermost_mattermost_server_v8 | >= 9.3.0 < 9.3.1 | 9.3.1 |
| mattermost | mattermost | — | — |
| mattermost | mattermost | 8.1.0 – 8.1.8 | — |
| mattermost | mattermost | 9.2.0 – 9.2.4 | — |
| mattermost | mattermost_server | — | — |
| mattermost | mattermost_server | >= 8.1.0 < 8.1.9 | 8.1.9 |
| mattermost | mattermost_server | >= 9.2.0 < 9.2.5 | 9.2.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server
osv·2024-06-28
CVE-2024-1942 Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server
Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server
Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.
GHSA
Mattermost allows attackers access to posts in channels they are not a member of
ghsa·2024-02-29
CVE-2024-1942 [MEDIUM] CWE-284 Mattermost allows attackers access to posts in channels they are not a member of
Mattermost allows attackers access to posts in channels they are not a member of
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.
OSV
Mattermost allows attackers access to posts in channels they are not a member of
osv·2024-02-29
CVE-2024-1942 [MEDIUM] Mattermost allows attackers access to posts in channels they are not a member of
Mattermost allows attackers access to posts in channels they are not a member of
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-29
Published