PT-2024-25722 · Mattermost · Mattermost

Bharat · CVE-2024-34152 · Published 2024-05-26 · Updated 2024-05-28

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1

Description The issue is related to improper access control, allowing a guest to obtain metadata of a public playbook run linked to the channel they are a guest in. This is achieved by sending an RHSRuns GraphQL query request to the server.

Recommendations For Mattermost versions 8.1.x through 8.1.12, update to a version that includes the fix for this issue. For Mattermost versions 9.5.x through 9.5.3, update to a version that includes the fix for this issue. For Mattermost versions 9.6.x through 9.6.1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the RHSRuns GraphQL query endpoint to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-34152

Affected Products

Mattermost

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34152.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34152 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34152 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34152 · Note