CVE-2024-11599CWE-754

Domain Restriction Bypass on Registration

High · published November 28, 2024

CVSS v3.1
8.2
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00468 · 39.5th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2024-11-28T09:42Z
EPSS history
Timeline
  • 28 NOV 09:42Z
    Domain Restriction Bypass on Registration
    cvelistv5