CVE-2024-36257CWE-284

Lack of permission check when updating the profile picture of a remote user (shared channels enabled)

Low · published July 3, 2024

CVSS v3.1
2.7
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-07-03T08:29Z
EPSS history
Timeline
  • 03 JUL 08:29Z
    Lack of permission check when updating the profile picture of a remote user (shared channels enabled)
    cvelistv5