CVE-2024-39777CWE-284

Malicious remote can invite itself to an arbitrary local channel

High · published August 1, 2024

CVSS v3.1
8.7
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00363 · 28.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-08-01T14:05Z
EPSS history
Timeline
  • 01 AUG 14:05Z
    Malicious remote can invite itself to an arbitrary local channel
    cvelistv5