CVE-2024-1949
published 2024-02-29CVE-2024-1949: A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual…
PriorityP410low2.6CVSS 3.1
AVNACHPRLUIRSUCLINAN
EPSS
0.27%
18.4th percentile
A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 9.0.0+incompatible < 9.4.2+incompatible | 9.4.2+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.1.9 | 8.1.9 |
| github.com | mattermost_mattermost_server_v8 | >= 9.0.0 < 9.4.2 | 9.4.2 |
| mattermost | mattermost | 8.1.0 – 8.1.8 | — |
| mattermost | mattermost | 9.4.0 – 9.4.1 | — |
| mattermost | mattermost_server | >= 8.1.0 < 8.1.9 | 8.1.9 |
| mattermost | mattermost_server | >= 9.4.0 < 9.4.2 | 9.4.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost race condition in github.com/mattermost/mattermost-server
osv·2024-06-28
CVE-2024-1949 Mattermost race condition in github.com/mattermost/mattermost-server
Mattermost race condition in github.com/mattermost/mattermost-server
Mattermost race condition in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.
OSV
Mattermost race condition
osv·2024-02-29
CVE-2024-1949 [LOW] Mattermost race condition
Mattermost race condition
A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.
GHSA
Mattermost race condition
ghsa·2024-02-29
CVE-2024-1949 [LOW] CWE-200 Mattermost race condition
Mattermost race condition
A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-29
Published