PT-2024-28468 · Mattermost · Mattermost

Juho Forsén + 1 · Published 2024-07-03 · Updated 2024-07-05 · CVE-2024-39353

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.5.x through 9.5.5 Mattermost version 9.8.0

Description The issue allows a high-privileged attacker with access to the audit logs to read message contents due to the failure to sanitize the RemoteClusterFrame payloads before audit logging them.

Recommendations For Mattermost versions 9.5.x through 9.5.5, update to a version that addresses this issue. For Mattermost version 9.8.0, update to a version that addresses this issue. As a temporary workaround, consider restricting access to the audit logs to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-39353

Affected Products

Mattermost

References · 3

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39353 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39353 · Vendor Advisory