CVE-2024-39832CWE-754

Permanently local data deletion by malicious remote

Medium · published August 1, 2024

CVSS v3.1
6.8
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently delete local data by abusing dangerous error handling, when share channels were enabled.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00460 · 39.0th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2024-08-01T14:05Z
EPSS history
Timeline
  • 01 AUG 14:05Z
    Permanently local data deletion by malicious remote
    cvelistv5