CVE-2024-32045
26.05.2024, 14:15
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channelwhich allows members to link their runs to private channels they were not members of.Enginsight
| Vendor | Product | Version |
|---|---|---|
| mattermost | mattermost_server | 8.1.0 ≤ 𝑥 < 8.1.13 |
| mattermost | mattermost_server | 9.5.0 ≤ 𝑥 < 9.5.4 |
| mattermost | mattermost_server | 9.6.0 ≤ 𝑥 < 9.6.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-284 - Improper Access ControlThe software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.