PT-2024-26935 · Mattermost · Mattermost

Juho Nurminen · CVE-2024-36255 · Published 2024-05-26 · Updated 2024-05-28

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1

Description The issue arises from inadequate input validation on post actions, allowing an attacker to execute a playbook checklist task command as another user. This can be achieved by creating and sharing a deceptive post action that unexpectedly runs a slash command in an arbitrary channel.

Recommendations For Mattermost versions 8.1.x through 8.1.12, update to a version later than 8.1.12 to resolve the issue. For Mattermost versions 9.5.x through 9.5.3, update to a version later than 9.5.3 to resolve the issue. For Mattermost versions 9.6.x through 9.6.1, update to a version later than 9.6.1 to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-36255

Affected Products

Mattermost

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36255.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-36255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36255 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36255 · Note