PT-2024-18446 · Mattermost · Mattermost

Juho Nurminen · Published 2024-02-29 · Updated 2024-12-16 · CVE-2024-1952

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 8.1.x through 8.1.8

Description The issue allows an authenticated attacker who can control the update of an ephemeral post to access individual posts' contents in channels they are not a member of. This is due to a failure to sanitize data associated with permalinks when a plugin updates an ephemeral post.

Recommendations For Mattermost versions 8.1.x through 8.1.8, update to version 8.1.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of plugins that update ephemeral posts until a patch is available. Additionally, restrict access to sensitive channels to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-MATTERMOST-2024-1952

CVE-2024-1952

GHSA-R4FM-G65H-CR54

GO-2024-2635

Affected Products

Mattermost

References · 11

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-1952 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r4fm-g65h-cr54 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2635 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2024-1952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1952 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://t.me/cvenotify/72680 · Telegram Post
• https://t.me/cvenotify/104226 · Telegram Post
• https://twitter.com/CVEnew/status/1763160714620084507 · Twitter Post
• https://github.com/advisories/GHSA-r4fm-g65h-cr54 · Note