PT-2024-16931 · Mattermost · Mattermost Android Mobile Apps

Bugsniper · Published 2024-12-16 · Updated 2024-12-18 · CVE-2024-11358

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Android Mobile Apps versions <=2.21.0

Description The issue arises from a misconfiguration of file providers in the Mattermost Android Mobile Apps, allowing an attacker with local access to access files via the file provider. This affects versions 2.21.0 and below.

Recommendations For versions <=2.21.0, update to a patched version to resolve the issue. As a temporary workaround, consider restricting access to the file provider to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-11358

Affected Products

Mattermost Android Mobile Apps

References · 8

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11358 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11358 · Vendor Advisory
• https://t.me/cvedetector/13023 · Telegram Post
• https://twitter.com/transilienceai/status/1869249530438226319 · Twitter Post
• https://twitter.com/CVEnew/status/1868699589101949213 · Twitter Post
• https://twitter.com/transilienceai/status/1869249537325306104 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1868843315799449791 · Twitter Post