PT-2024-28671 · Mattermost · Mattermost
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N |
Name of the Vulnerable Software and Affected Versions
Mattermost versions 9.9.x through 9.9.0
Mattermost versions 9.5.x through 9.5.6
Mattermost versions 9.7.x through 9.7.5
Mattermost versions 9.8.x through 9.8.1
Description
The issue allows malicious remote users to send unsolicited invites, exposing access to local channels when shared channels are enabled. This can lead to a local channel becoming shared without the consent of the local admin, by sending an invite with the ID of an existing local channel.
Recommendations
For Mattermost versions 9.9.x through 9.9.0, update to a version that includes the fix for this issue.
For Mattermost versions 9.5.x through 9.5.6, update to a version that includes the fix for this issue.
For Mattermost versions 9.7.x through 9.7.5, update to a version that includes the fix for this issue.
For Mattermost versions 9.8.x through 9.8.1, update to a version that includes the fix for this issue.
As a temporary workaround, consider disabling shared channels until a patch is available.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mattermost