Skip to content
OpenAdvisories
Low WID-SEC-2024-1612 2 CVEs

Mattermost: Mehrere Schwachstellen

Published Jul 15, 2024 · Updated Jul 15, 2024 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Android Platform: iOS

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um Dateien zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 2

  • Medium 4.2
    CVE-2024-39767

    Spoofed push notifications from malicious server

    Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and hav…

    Mattermost Mattermost
  • Low 2.6
    CVE-2024-32945

    LaTeX post content manipulation via renderer state leak across contexts

    Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a LateX post, by creating another post with specific macro definitions.

    Mattermost Mattermost

Revision history

  1. #1

    Initiale Fassung

References