Vulnerability record/PUBLISHED/Published Aug 1, 2024 14:05:00 UTC
CVE-2024-29977
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create arbitrary reactions on arbitrary posts
Base score2.7/ 10
SeverityLowCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityLow
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredHighPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactLowI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityMattermost
Last updatedAug 1, 2024 14:35:07 UTC
PublishedAug 1, 2024 14:05:00 UTC
ReservedJul 23, 2024 19:00:08 UTC
Credits
- Juho Forsén