PT-2024-24246 · Mattermost · Mattermost

Bharat · CVE-2024-31859 · Published 2024-05-26 · Updated 2024-05-28

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1

Description The issue is related to improper authorization checks. This allows a member running a playbook in an existing channel to be promoted to a channel admin.

Recommendations For versions 8.1.x through 8.1.12, update to a version that includes the necessary authorization checks. For versions 9.5.x through 9.5.3, update to a version that includes the necessary authorization checks. For versions 9.6.x through 9.6.1, update to a version that includes the necessary authorization checks.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-31859

Affected Products

Mattermost

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31859.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-31859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31859 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31859 · Note