Vulnerability record/PUBLISHED/Published Aug 1, 2024 14:05:10 UTC
CVE-2024-41926
Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.
Base score2.7/ 10
SeverityLowCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityLow
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredHighPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactLowI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityMattermost
Last updatedAug 1, 2024 14:32:10 UTC
PublishedAug 1, 2024 14:05:10 UTC
ReservedJul 23, 2024 18:35:14 UTC
Credits
- Juho Forsén