PT-2024-30675 · Mattermost · Mattermost

C0Rydoras + 1 · Published 2024-08-22 · Updated 2024-08-23 · CVE-2024-43813

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.5.x through 9.5.7 Mattermost versions 9.10.x through 9.10.0

Description The issue is related to improper access controls, allowing any authenticated user, including guests, to mark any channel inside any team as read for any user. This affects the ability to enforce proper access controls within the system.

Recommendations For Mattermost versions 9.5.x through 9.5.7, update to a version later than 9.5.7 to resolve the issue. For Mattermost versions 9.10.x through 9.10.0, update to a version later than 9.10.0 to resolve the issue. As a temporary workaround, consider restricting access to sensitive channels and teams to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-43813

Affected Products

Mattermost

References · 7

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43813 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43813 · Security Note
• https://twitter.com/VulmonFeeds/status/1826574891044274304 · Twitter Post
• https://twitter.com/oktsec/status/1826548452253143155 · Twitter Post
• https://twitter.com/CVEnew/status/1826518546945568954 · Twitter Post
• https://t.me/cvedetector/3898 · Telegram Post