CVE-2024-2447
published 2024-04-05CVE-2024-2447: Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.22%
13.1th percentile
Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 9.3.0+incompatible < 9.3.3+incompatible | 9.3.3+incompatible |
| github.com | mattermost_mattermost-server | >= 9.4.0+incompatible < 9.4.4+incompatible | 9.4.4+incompatible |
| github.com | mattermost_mattermost-server | >= 9.5.0+incompatible < 9.5.2+incompatible | 9.5.2+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 8.1.0 < 8.1.11 | 8.1.11 |
| github.com | mattermost_mattermost_server_v8 | >= 9.3.0 < 9.3.3 | 9.3.3 |
| github.com | mattermost_mattermost_server_v8 | >= 9.4.0 < 9.4.4 | 9.4.4 |
| github.com | mattermost_mattermost_server_v8 | >= 9.5.0 < 9.5.2 | 9.5.2 |
| mattermost | mattermost | 8.1.0 – 8.1.10 | — |
| mattermost | mattermost | 9.3.0 – 9.3.2 | — |
| mattermost | mattermost | 9.4.0 – 9.4.3 | — |
| mattermost | mattermost | 9.5.0 – 9.5.1 | — |
| mattermost | mattermost_server | >= 8.1.0 < 8.1.11 | 8.1.11 |
| mattermost | mattermost_server | >= 9.3.0 < 9.3.3 | 9.3.3 |
| mattermost | mattermost_server | >= 9.4.0 < 9.4.4 | 9.4.4 |
| mattermost | mattermost_server | >= 9.5.0 < 9.5.2 | 9.5.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost fails to authenticate the source of certain types of post actions in github.com/mattermost/mattermost-server
osv·2024-06-05
CVE-2024-2447 Mattermost fails to authenticate the source of certain types of post actions in github.com/mattermost/mattermost-server
Mattermost fails to authenticate the source of certain types of post actions in github.com/mattermost/mattermost-server
Mattermost fails to authenticate the source of certain types of post actions in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 from v8.1.0 before v8.1.11.
GHSA
Mattermost fails to authenticate the source of certain types of post actions
ghsa·2024-04-05
CVE-2024-2447 [HIGH] CWE-284 Mattermost fails to authenticate the source of certain types of post actions
Mattermost fails to authenticate the source of certain types of post actions
Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.
OSV
Mattermost fails to authenticate the source of certain types of post actions
osv·2024-04-05
CVE-2024-2447 [HIGH] Mattermost fails to authenticate the source of certain types of post actions
Mattermost fails to authenticate the source of certain types of post actions
Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-05
Published