CVE-2024-41926CWE-284

Malicious remote can claim that a user was synced from another remote

Low · published August 1, 2024

CVSS v3.1
2.7
EPSS
0%
Percentile
6.6
In the wild
Unconfirmed
What it is

Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-08-01T14:05Z
EPSS history
Timeline
  • 01 AUG 14:05Z
    Malicious remote can claim that a user was synced from another remote
    cvelistv5