PT-2024-9758 · Mattermost+1 · Mattermost+1

Jesse Hallam

·

Published

2024-10-29

·

Updated

2024-11-08

·

CVE-2024-50052

CVSS v4.0

5.3

Medium

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Mattermost versions 9.5.x through 9.5.9 Mattermost versions 9.10.x through 9.10.2 Mattermost versions 9.11.x through 9.11.1
Description The issue is related to the lack of authorization procedure in the Mattermost application, which allows an authenticated user to delete an arbitrary post. This is due to the failure to check if the origin of the message in an integration action matches the original post metadata.
Recommendations For Mattermost versions 9.5.x through 9.5.9, update to a version later than 9.5.9 to resolve the issue. For Mattermost versions 9.10.x through 9.10.2, update to a version later than 9.10.2 to resolve the issue. For Mattermost versions 9.11.x through 9.11.1, update to a version later than 9.11.1 to resolve the issue. As a temporary workaround, consider restricting access to integration actions to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-11496
CVE-2024-50052
GHSA-G376-M3H3-MJ4R
GO-2024-3235
OPENSUSE-SU-2024:0350-1
OPENSUSE-SU-2024:14458-1
OPENSUSE-SU-2024_3950-1
SUSE-SU-2024:3950-1

Affected Products

Mattermost
Suse