CVE-2024-47003
published 2024-09-26CVE-2024-47003: Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a…
PriorityP433medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.58%
44.1th percentile
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20240806094731-69a8b3df0f9f | 8.0.0-20240806094731-69a8b3df0f9f |
| mattermost | mattermost | — | — |
| mattermost | mattermost | 9.5.0 – 9.5.8 | — |
| mattermost | mattermost_server | — | — |
| mattermost | mattermost_server | >= 9.5.0 < 9.5.9 | 9.5.9 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events in github.com/mattermost/mattermost-server
osv·2024-10-10
CVE-2024-47003 Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events in github.com/mattermost/mattermost-server
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events in github.com/mattermost/mattermost-server
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events in github.com/mattermost/mattermost-server
OSV
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events
osv·2024-09-26
CVE-2024-47003 [MEDIUM] Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events
Mattermost does not strip `embeds` from `metadata` when broadcasting `posted` events.
This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a client Side Denial of Service (DoS) by sending a permalink with a non-string message.
The advisory metadata references the appropriate go pseudo version available from pkg.go.dev
GHSA
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events
ghsa·2024-09-26
CVE-2024-47003 [MEDIUM] CWE-400 Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events
Mattermost does not strip `embeds` from `metadata` when broadcasting `posted` events.
This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a client Side Denial of Service (DoS) by sending a permalink with a non-string message.
The advisory metadata references the appropriate go pseudo version available from pkg.go.dev
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-09-26
Published