CVE-2024-9155

published 2024-09-26

CVE-2024-9155: Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an…

Priority P4 22 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
mattermost	mattermost	9.10.0 – 9.10.1	—
mattermost	mattermost	9.5.0 – 9.5.8	—
mattermost	mattermost	9.9.0 – 9.9.2	—
mattermost	mattermost_server	>= 9.10.0 < 9.10.2	9.10.2
mattermost	mattermost_server	>= 9.5.0 < 9.5.9	9.5.9
mattermost	mattermost_server	>= 9.9.0 < 9.9.3	9.9.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-863