CVE-2024-39767

published 2024-07-15

CVE-2024-39767: Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a…

medium 6.5 CVSS 3.1

AV N AC L PR N UI N S U C L I L A N

Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and have them show up in mobile apps as that server’s push notifications.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mattermost	mattermost	<= 2.16.0	—
mattermost	mattermost_mobile	< 2.17.0	2.17.0

CWE-287