CVE-2024-39836CWE-693

Munged email address used for password resets and notifications

Medium · published August 22, 2024

CVSS v3.1
4.8
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 17.0th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2024-08-22T06:27Z
EPSS history
Timeline
  • 22 AUG 06:27Z
    Munged email address used for password resets and notifications
    cvelistv5