CVE-2024-39777
Last modified
CVE-2024-39777 is a critical-severity vulnerability rated 9.6/10 on the CVSS scale. Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.. EPSS estimates a 0.36% chance of exploitation in the next 30 days.
Description
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | >= 9.5.0, < 9.5.7 |
| Mattermost | Mattermost | >= 9.7.0, < 9.7.6 |
| Mattermost | Mattermost | >= 9.8.0, < 9.8.2 |
| Mattermost | Mattermost | 9.9.0 |
References
- https://mattermost.com/security-updatesVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-39777?
How severe is CVE-2024-39777?
How do I fix CVE-2024-39777?
Are you affected by CVE-2024-39777?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST