PT-2024-29684 · Mattermost · Mattermost

Othman · Published 2024-11-09 · Updated 2024-11-15 · CVE-2024-42000

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.5.x through 9.5.9 Mattermost versions 9.10.x through 9.10.2 Mattermost versions 9.11.x through 9.11.1 Mattermost versions 10.0.x through 10.0.0

Description The issue allows a User or System Manager with "Read Groups" permission but no access to channels to retrieve details about private channels they are not a member of by sending a request to "/api/v4/channels". This is due to a request authorization issue in the affected Mattermost versions.

Recommendations For versions 9.5.x through 9.5.9, upgrade to a version higher than 9.5.9 to resolve the issue. For versions 9.10.x through 9.10.2, upgrade to a version higher than 9.10.2 to resolve the issue. For versions 9.11.x through 9.11.1, upgrade to a version higher than 9.11.1 to resolve the issue. For versions 10.0.x through 10.0.0, upgrade to a version higher than 10.0.0 to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-MATTERMOST-2024-42000

CVE-2024-42000

Affected Products

Mattermost

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-42000 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42000 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2024-42000 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1855384838561210482 · Twitter Post
• https://twitter.com/CVEnew/status/1855303833586733332 · Twitter Post
• https://t.me/cvedetector/10411 · Telegram Post
• https://twitter.com/oktsec/status/1855364141743288743 · Twitter Post