cbcvebase.
CVE-2024-39837
published 2024-08-01

CVE-2024-39837: Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels…

PriorityP432medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.28%
20.4th percentile
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.

Affected

13 ranges
VendorProductVersion rangeFixed in
github.commattermost_mattermost-server>= 9.5.0 < 9.5.79.5.7
github.commattermost_mattermost-server>= 9.5.0+incompatible < 9.5.7+incompatible9.5.7+incompatible
github.commattermost_mattermost-server>= 9.9.0 < 9.9.19.9.1
github.commattermost_mattermost-server>= 9.9.0+incompatible < 9.9.1+incompatible9.9.1+incompatible
github.commattermost_mattermost-server_v5>= 0 < 5.3.2-0.20240626164322-c758cecaf30c5.3.2-0.20240626164322-c758cecaf30c
github.commattermost_mattermost-server_v6>= 0 < 6.0.0-20240626164322-c758cecaf30c6.0.0-20240626164322-c758cecaf30c
github.commattermost_mattermost_server_v8>= 0 < 8.0.0-20240626164322-c758cecaf30c8.0.0-20240626164322-c758cecaf30c
github.commattermost_mattermost_server_v8>= 9.5.0 < 9.5.79.5.7
github.commattermost_mattermost_server_v8>= 9.9.0 < 9.9.19.9.1
mattermostmattermost——
mattermostmattermost9.5.0 – 9.5.6—
mattermostmattermost_server——
mattermostmattermost_server>= 9.5.0 < 9.5.79.5.7
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.