Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-39777

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.

Published

2024-08-01T15:15:12.370

Last Modified

2024-08-23T14:36:48.817

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.7 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-284
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mattermost mattermost < 9.5.7 Yes
Application mattermost mattermost < 9.7.6 Yes
Application mattermost mattermost < 9.8.2 Yes
Application mattermost mattermost 9.9.0 Yes
References