CVE-2024-41926
published 2024-08-01CVE-2024-41926: Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a…
medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost | >= 0 < 5.3.2-0.20240604093018-5114c3b7cdb8 | 5.3.2-0.20240604093018-5114c3b7cdb8 |
| github.com | mattermost_mattermost-server | >= 9.5.0+incompatible < 9.5.7+incompatible | 9.5.7+incompatible |
| github.com | mattermost_mattermost-server | >= 9.9.0+incompatible < 9.9.1+incompatible | 9.9.1+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20240604093018-5114c3b7cdb8 | 8.0.0-20240604093018-5114c3b7cdb8 |
| github.com | mattermost_mattermost_server_v8 | >= 9.5.0 < 9.5.7 | 9.5.7 |
| github.com | mattermost_mattermost_server_v8 | >= 9.9.0 < 9.9.1 | 9.9.1 |
| mattermost | mattermost | — | — |
| mattermost | mattermost | 9.5.0 – 9.5.6 | — |
| mattermost | mattermost_server | — | — |
| mattermost | mattermost_server | >= 9.5.0 < 9.5.7 | 9.5.7 |