GitHub Advisoryadvisory · Go
GHSA-g376-m3h3-mj4r Mattermost server allows authenticated user to delete arbitrary post
MEDIUM
Official page ↗
- Aliases
- CVE-2024-50052
- Ecosystem
- Go
- Packages
- github.com/mattermost/mattermost/server/v8
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-862
- Reviewed
- 2024-10-29
Affected packages
• Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20240926115259-20ed58906adc → fixed in 8.0.0-20240926115259-20ed58906adc
Description
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.
Related
Alias · CVE (1)
- CVE-2024-50052 Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration… vulnerability
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness