Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-39839

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the local server as long as the user hadn't been synced before.

Published

2024-08-01T15:15:12.993

Last Modified

2024-09-04T17:34:06.817

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 4.3 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-284
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mattermost mattermost_server < 9.5.7 Yes
Application mattermost mattermost_server < 9.7.6 Yes
Application mattermost mattermost_server < 9.8.2 Yes
Application mattermost mattermost_server 9.9.0 Yes
References