GitHub Advisoryadvisory · Go

GHSA-wp43-vprh-c3w5 Mattermost fails to authenticate the source of certain types of post actions

HIGH Published 2024-04-05 Modified 2024-11-18 Official page ↗
Aliases
CVE-2024-2447
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284
Reviewed
2024-04-05

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 8.1.0, < 8.1.11 → fixed in 8.1.11 • Go github.com/mattermost/mattermost/server/v8: >= 9.5.0, < 9.5.2 → fixed in 9.5.2 • Go github.com/mattermost/mattermost/server/v8: >= 9.4.0, < 9.4.4 → fixed in 9.4.4 • Go github.com/mattermost/mattermost/server/v8: >= 9.3.0, < 9.3.3 → fixed in 9.3.3

Description

Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.

Related

Alias · CVE (1)

  • CVE-2024-2447 Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References