Skip to content
OpenAdvisories
Low · 3.8 CVE-2024-39837 BIT-mattermost-2024-39837EUVD-2024-2667GHSA-vvpg-55p7-5h8wGO-2024-3032

Malicious remote can create arbitrary channels

Published Aug 1, 2024 · Updated Aug 1, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost 9.9.0, 9.5.0 – ≤ 9.5.6 9.10.0

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server >= 9.9.0, < 9.9.1 9.9.1 GHSA-vvpg-55p7-5h8w
Go github.com/mattermost/mattermost-server >= 9.5.0, < 9.5.7 9.5.7 GHSA-vvpg-55p7-5h8w
Go github.com/mattermost/mattermost-server >= 9.5.0+incompatible, < 9.5.7+incompatible · >= 9.9.0+incompatible, < 9.9.1+incompatible 9.5.7+incompatible, 9.9.1+incompatible GO-2024-3032
Go github.com/mattermost/mattermost-server/v5 < 5.3.2-0.20240626164322-c758cecaf30c 5.3.2-0.20240626164322-c758cecaf30c GHSA-vvpg-55p7-5h8w
Go github.com/mattermost/mattermost-server/v5 all versions — GO-2024-3032
Go github.com/mattermost/mattermost-server/v6 < 6.0.0-20240626164322-c758cecaf30c 6.0.0-20240626164322-c758cecaf30c GHSA-vvpg-55p7-5h8w
Go github.com/mattermost/mattermost-server/v6 all versions — GO-2024-3032
Go github.com/mattermost/mattermost/server/v8 >= 9.5.0, < 9.5.7 9.5.7 GHSA-vvpg-55p7-5h8w
Go github.com/mattermost/mattermost/server/v8 >= 9.9.0, < 9.9.1 9.9.1 GHSA-vvpg-55p7-5h8w
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20240626164322-c758cecaf30c 8.0.0-20240626164322-c758cecaf30c GHSA-vvpg-55p7-5h8w
Go github.com/mattermost/mattermost/server/v8 all versions — GO-2024-3032

Advisories 1

References