CVE-2024-39830CWE-287

Timing attack during remote cluster token comparison when shared channels are enabled

High · published July 3, 2024

CVSS v3.1
8.1
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison for remote cluster tokens which allows an attacker to retrieve the remote cluster token via a timing attack during remote cluster token comparison.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-07-03T08:32Z
EPSS history
Timeline
  • 03 JUL 08:32Z
    Timing attack during remote cluster token comparison when shared channels are enabled
    cvelistv5