PT-2024-20411 · Mattermost · Mattermost

Juho Nurminen · CVE-2024-2447 · Published 2024-04-05 · Updated 2024-12-16

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 8.1.x through 8.1.10 Mattermost versions 9.3.x through 9.3.2 Mattermost versions 9.4.x through 9.4.3 Mattermost versions 9.5.x through 9.5.1

Description The issue is related to the failure of Mattermost to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.

Recommendations For versions 8.1.x through 8.1.10, update to version 8.1.11 or later. For versions 9.3.x through 9.3.2, update to version 9.3.3 or later. For versions 9.4.x through 9.4.3, update to version 9.4.4 or later. For versions 9.5.x through 9.5.1, update to version 9.5.2 or later.

Exploit

Fix

DoS

Improper Access Control

Origin Validation Error

Weakness Enumeration

CWE-284

CWE-346

Related Identifiers

BIT-MATTERMOST-2024-2447

CVE-2024-2447

GHSA-WP43-VPRH-C3W5

GO-2024-2696

Affected Products

Mattermost

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2447.json · Exploit
• https://osv.dev/vulnerability/GO-2024-2696 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wp43-vprh-c3w5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2447 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2447 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2024-2447 · Vendor Advisory
• https://github.com/advisories/GHSA-wp43-vprh-c3w5 · Note
• https://twitter.com/CVEnew/status/1776176704882352325 · Twitter Post
• https://t.me/cvenotify/104200 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2447 · Note