Skip to content
OpenAdvisories
Medium WID-SEC-2024-1957 5 CVEs

Mattermost Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Aug 29, 2024 · Updated Sep 29, 2024 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Mattermost Server ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 5

  • Medium 5.4
    CVE-2024-42406

    Unauthorized access on archived channels

    Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. E…

    Mattermost Mattermost
  • Medium 4.3
    CVE-2024-9155

    Insufficient Authorization On Unlinked Channel Files

    Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of.

    Mattermost Mattermost
  • Low 3.1
    CVE-2024-45843

    Weak SSRF Filtering

    Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.

    Mattermost Mattermost
  • Low 3.1
    CVE-2024-47003

    DoS via non-string message using permalink embed

    Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Low 3.1
    CVE-2024-47145

    Unauthorized access on archived channels via file links

    Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.

    Mattermost Mattermost

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References