CVE-2024-4198
EUVD-2024-110726.04.2024, 09:15
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| mattermost | mattermost_server | 8.1.0 ≤ 𝑥 < 8.1.12 |
| mattermost | mattermost_server | 9.5.0 ≤ 𝑥 < 9.5.3 |
| mattermost | mattermost_server | 9.6.0 |
| mattermost | mattermost_server | 9.6.0:rc1 |
| mattermost | mattermost_server | 9.6.0:rc2 |
| mattermost | mattermost_server | 9.6.0:rc3 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| mattermost | mattermost | 9.6.0 | CNA |
| mattermost | mattermost | 9.5.0 ≤ 𝑥 ≤ 9.5.2 | CNA |
| mattermost | mattermost | 8.1.0 ≤ 𝑥 ≤ 8.1.11 | CNA |
Common Weakness Enumeration