PT-2024-27360 · Mattermost · Mattermost Desktop App

Gee-Netics · Published 2024-06-14 · Updated 2024-08-07 · CVE-2024-37182

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Desktop App versions <=5.7.0

Description The issue allows a remote attacker to force a victim to run arbitrary programs on their system via custom URI schemes, due to the application's failure to correctly prompt for permission when opening external URLs.

Recommendations For Mattermost Desktop App versions <=5.7.0, update to a version greater than 5.7.0 to resolve the issue. As a temporary workaround, consider disabling the handling of custom URI schemes in the application until a patch is available. Restrict access to external URLs to minimize the risk of exploitation. Avoid using the Mattermost Desktop App to open external URLs from untrusted sources until the issue is resolved.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2024-37182

GHSA-HVXG-77MG-VRVP

Affected Products

Mattermost Desktop App

References · 7

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37182 · Security Note
• https://osv.dev/vulnerability/GHSA-hvxg-77mg-vrvp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37182 · Vendor Advisory
• https://github.com/mattermost/desktop · Note
• https://github.com/mattermost/desktop/commit/1c9fc719dc2b74495a05f7ebc90e92e7daa03e6d · Note
• https://twitter.com/CVEnew/status/1801547303997612463 · Twitter Post