Skip to content
OpenAdvisories
Medium WID-SEC-2024-3051 3 CVEs

Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Sep 29, 2024 · Updated Nov 10, 2024 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 3

  • Medium 4.3
    CVE-2024-52032

    Private channel names leaking when Elasticsearch is enabled

    Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elast…

    Mattermost Mattermost
  • Low 3.1
    CVE-2024-36250

    MFA Code Replay

    Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds

    Mattermost Mattermost
  • Low 2.7
    CVE-2024-42000

    Unauthorized Access to view channels' details

    Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels  which allows a User or System Manager, with "Read Groups" permission but with no access for channels to re…

    Mattermost Mattermost

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References