PT-2024-31800 · Google+1 · Chromium+1

Doyensec · Published 2024-09-16 · Updated 2024-11-01 · CVE-2024-45835

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost Desktop App versions <=5.8.0

Description: The Mattermost Desktop App fails to sufficiently configure Electron Fuses, allowing an attacker to gather Chromium cookies or abuse other misconfigurations via remote or local access. This issue can be exploited locally.

Recommendations: For Mattermost Desktop App versions <=5.8.0, upgrade the affected component to a version that properly configures Electron Fuses to prevent exploitation. As a temporary workaround, consider restricting access to sensitive data stored in Chromium cookies until the issue is resolved.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BIT-MATTERMOST-2024-45835

CVE-2024-45835

GHSA-XGQ9-7GW6-JR5R

Affected Products

Chromium

Mattermost Desktop App

References · 10

• https://osv.dev/vulnerability/GHSA-xgq9-7gw6-jr5r · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2024-45835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45835 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45835 · Vendor Advisory
• https://github.com/mattermost/desktop · Note
• https://twitter.com/VulmonFeeds/status/1835724237895614525 · Twitter Post
• https://twitter.com/oktsec/status/1835713835254038776 · Twitter Post
• https://twitter.com/CVEnew/status/1835688853228650666 · Twitter Post
• https://t.me/cvedetector/5729 · Telegram Post