8.7
CVE-2024-39274
- EPSS 0.2%
- Veröffentlicht 01.08.2024 15:15:12
- Zuletzt bearbeitet 23.08.2024 14:39:29
- Quelle responsibledisclosure@mattermo
- Teams Watchlist Login
- Unerledigt Login
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add users to arbitrary teams and channels
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mattermost ≫ Mattermost Version >= 9.5.0 < 9.5.7
Mattermost ≫ Mattermost Version >= 9.7.0 < 9.7.6
Mattermost ≫ Mattermost Version >= 9.8.0 < 9.8.2
Mattermost ≫ Mattermost Version9.9.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.2% | 0.426 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
|
| responsibledisclosure@mattermost.com | 8.7 | 2.3 | 5.8 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.