CVE-2024-31859 — Improper Access Control in Server

CWE-284 — Improper Access Control2 documents2 sources

Severity

6.3MEDIUMNVD

CNA4.3

EPSS

0.1%

top 70.80%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mattermost Server Mattermost

Timeline

PublishedMay 26

Description

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages2 packages

▶NVDmattermost/mattermost_server8.1.0 — 8.1.13+2

▶CVEListV5mattermost/mattermost9.5.0 — 9.5.3+2

🔴Vulnerability Details

CVEList

Member promoted to channel admin via playbooks run linking to channel↗2024-05-26

▶