Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2024-39837

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.

VectorNETWORK

PublishedAug 01, 2024, 15:15

Published Byresponsibledisclosure@mattermost.com

Base Score

Score5.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/mattermost/mattermost/server/v8(Go)9.5.09.5.7N/A

github.com/mattermost/mattermost/server/v8(Go)9.9.09.9.1N/A

github.com/mattermost/mattermost/server/v8(Go)08.0.0-20240626164322-c758cecaf30cN/A

github.com/mattermost/mattermost-server(Go)9.9.09.9.1N/A

github.com/mattermost/mattermost-server/v5(Go)05.3.2-0.20240626164322-c758cecaf30cN/A

github.com/mattermost/mattermost-server/v6(Go)06.0.0-20240626164322-c758cecaf30cN/A

github.com/mattermost/mattermost-server(Go)9.5.09.5.7N/A

References

https://mattermost.com/security-updates

Weakness Type

NVD-CWE-noinfo

CVSS Metrics

Base Score

5.4

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK