5.4

CVE-2024-42406

Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files.

Data is provided by the National Vulnerability Database (NVD)
Mattermost ≫ Mattermost Server Version >= 9.5.0 < 9.5.9
Mattermost ≫ Mattermost Server Version >= 9.9.0 < 9.9.3
Mattermost ≫ Mattermost Server Version >= 9.10.0 < 9.10.2
Mattermost ≫ Mattermost Server Version9.11.0 Update-
Mattermost ≫ Mattermost Server Version9.11.0 Updaterc1
Mattermost ≫ Mattermost Server Version9.11.0 Updaterc2
Mattermost ≫ Mattermost Server Version9.11.0 Updaterc3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.09% 0.271
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
responsibledisclosure@mattermost.com 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.