GitHub Advisoryadvisory · Go

GHSA-3g35-v53r-gpxc Mattermost race condition

LOW Published 2024-02-29 Modified 2024-12-13 Official page ↗
Aliases
CVE-2024-1949
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-362
Reviewed
2024-02-29

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 9.0.0, < 9.4.2 → fixed in 9.4.2 • Go github.com/mattermost/mattermost/server/v8: < 8.1.9 → fixed in 8.1.9

Description

A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.

Related

Alias · CVE (1)

  • CVE-2024-1949 A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References