Communication and Collaboration

In Discourse versions stable 3.3.2 and prior; beta 3.4.0.beta3 and prior; tests-passed 3.4.0.beta3 and prior a medium severity vulnerability CVE-2024-49765 was detected. This vulnerability allows attackers to bypass Discourse Connect and create accounts or log in if local login methods are still enabled. To address this issue, users should upgrade Discourse to the stable 3.3.3 or above; beta 3.4.0.beta4 or above; tests-passed 3.4.0.beta4 or above versions. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-49765.

In Mattermost versions 10.1.x up to10.1.2, 10.0.x up to10.0.2, 9.11.x up to 9.11.4, and 9.5.x up to 9.5.12 a medium severity vulnerability CVE-2024-48872 was detected. This vulnerability allows attackers to bypass the “Max failed attempts” restriction by sending a large number of simultaneous login requests, enabling multiple login attempts before being blocked. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-48872.

In Mattermost Android Mobile Apps versions 2.21.0 and prior a medium severity vulnerability CVE-2024-11358 was detected. This vulnerability allows attackers with local access to access files via file providers. To address this issue, users should upgrade to version 2.22.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-11358.

In Mattermost versions 10.1.x up to 10.1.2, 10.0.x up to 10.0.2, 9.11.x up to 9.11.4, and 9.5.x up to 9.5.12 a medium severity vulnerability CVE-2024-54682 was detected. This vulnerability allows attackers to upload specially crafted files (zip bombs) that can overload and crash the system, causing it to stop working properly. To fix this issue, users should upgrade Mattermost to versions 10.1.3, 10.0.3, 9.11.5 and 9.5.13. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-54682.

In Mattermost versions 9.7.x up to 9.7.5, 9.8.x up to 9.8.2, and 9.9.x up to 9.9.2 a medium severity vulnerability CVE-2024-12247 was detected. This vulnerability allows users keep old permissions even when permission updates are made, as the updates don’t apply across all cluster nodes. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12247.

In Zulip version 8.3 a medium severity vulnerability CVE-2024-36625 was detected. This vulnerability allows attackers to inject malicious scripts into the application, which can then be executed in the context of other users’ browsers. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-36625.

In Zulip version 8.3 a medium severity vulnerability CVE-2024-36624 was detected. This vulnerability allows attackers to exploit the application using Cross Site Scripting (XSS) techniques. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-36624.

In Zulip versions 8.0 to 8.3 a high severity vulnerability CVE-2024-36612 was detected. This vulnerability allows attackers to exploit a memory leak in the handling of popovers. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-36612.

In Mattermost versions 10.0.x up to and including 10.0.1, 10.1.x up to and including 10.1.1, 9.11.x up to and including 9.11.3, 9.5.x up to and including 9.5.11 a high severity vulnerability CVE-2024-11599 was detected. This vulnerability allows unauthenticated users to bypass email domain restrictions during registration via crafted email input. To address this issue, users must upgrade to Mattermost versions 10.2.0, 10.0.2, 10.1.2, 9.11.4, 9.5.12 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11599.