CVE-2024-39777 — Improper Access Control in Mattermost Mattermost-server

CWE-284 — Improper Access Control5 documents4 sources
Severity
9.6CRITICALNVD
CNA8.7
EPSS
0.3%
top 48.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Mattermost Mattermost-serverGithub.com Mattermost Mattermost Server V8Mattermost
Timeline
PublishedAug 1
Latest updateAug 30

Description

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NExploitability: 3.1 | Impact: 5.8

Affected Packages4 packages

▶NVDmattermost/mattermost9.5.0 — 9.5.7+3
▶Gogithub.com/mattermost_mattermost-server9.5.0+incompatible — 9.5.7+incompatible+3
▶CVEListV5mattermost/mattermost9.5.0 — 9.5.6+3

🔴Vulnerability Details

4
OSV
Mattermost allows unsolicited invites to expose access to local channels in github.com/mattermost/mattermost-server↗2024-08-30
▶
CVEList
Malicious remote can invite itself to an arbitrary local channel↗2024-08-01
▶
GHSA
Mattermost allows unsolicited invites to expose access to local channels↗2024-08-01
▶
OSV
Mattermost allows unsolicited invites to expose access to local channels↗2024-08-01
▶
CVE-2024-39777 — Improper Access Control | cvebase