by Kastro
Paper/Archive/CVE-2024-39777

CVE-2024-39777

Mattermost Mattermost — Malicious remote can invite itself to an arbitrary local channel

EPSS 0.4%CVSS 9.6
critical.is priorityof 100
35
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 30.1.301 × 206.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.

Affected

ProductAffectedFixed inSource
Mattermost9.9.09.10.0CNA
Mattermost9.5.0 – 9.5.69.10.0CNA
Mattermost9.7.0 – 9.7.59.10.0CNA
Mattermost9.8.0 – 9.8.19.10.0CNA
mattermost9.9.09.10.0CISA-ADP
mattermost9.5.0 – 9.5.69.10.0CISA-ADP
mattermost9.7.0 – 9.7.59.10.0CISA-ADP
mattermost9.8.0 – 9.8.19.10.0CISA-ADP

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Mattermost (CNA)8.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refmattermost.com/security-updates