PT-2024-19090 · Mattermost · Mattermost Server

Leandro Chaves · Published 2024-04-05 · Updated 2024-12-16 · CVE-2024-21848

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Server versions 8.1.x before 8.1.11

Description The issue is related to improper access control, allowing an attacker to continue participating in a call even after being removed from the channel. This occurs when the attacker is in a channel with an active call.

Recommendations For versions 8.1.x before 8.1.11, update to version 8.1.11 or later to resolve the issue. As a temporary workaround, consider restricting access to channels with active calls to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-273

Related Identifiers

BIT-MATTERMOST-2024-21848

CVE-2024-21848

GHSA-XP9J-8P68-9Q93

GO-2024-2707

Affected Products

Mattermost Server

References · 12

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2024-21848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21848 · Security Note
• https://osv.dev/vulnerability/GHSA-xp9j-8p68-9q93 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2707 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21848 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://t.me/cvenotify/104198 · Telegram Post
• https://github.com/advisories/GHSA-xp9j-8p68-9q93 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21848 · Note
• https://t.me/cvenotify/75821 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1776198230377701774 · Twitter Post