In Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 a medium severity vulnerability CVE-2024-39810 was detected. The ElasticSearch configuration lacks time and size limits on the CA path file, allowing a user with console access to add files like /dev/zero, which can crash the application. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-39810.
Read more Communication
In Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, and 9.8.x <= 9.8.2 a medium severity vulnerability CVE-2024-39836 was detected. Mattermost versions have a vulnerability where remote or synthetic users can use munged email addresses from shared channels to create sessions and reset passwords if the emails are valid. To fix this problem, users should upgrade to version 9.11.0, 9.9.2, 9.5.8, 9.10.1, or 9.8.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-39836.
Read more Communication
In Mattermost versions 9.9.x ≤ 9.9.1, 9.5.x ≤ 9.5.7, 9.10.x ≤ 9.10.0, and 9.8.x ≤ 9.8.2 a medium severity vulnerability CVE-2024-40886 was detected. This vulnerability allows attackers to perform a one-click path traversal and launch a CSRF attack on the User Management page. To fix this problem, users should upgrade to version 9.11.0, 9.9.2, 9.5.8, 9.10.1, 9.8.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-40886.
Read more Communication
In Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 a medium severity vulnerability CVE-2024-42411 was detected. This vulnerability allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older. To fix this problem, users must upgrade to 9.11.0, 9.9.2, 9.5.8, 9.10.1, 9.8.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-42411.
In Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, and 9.8.x <= 9.8.2 a medium severity vulnerability CVE-2024-42497 was detected. This vulnerability allows attackers with read-only access to teams to escalate their permissions and make unauthorized changes to team data, potentially affecting the integrity and confidentiality of the Mattermost system. To fix this problem, users should upgrade Mattermost to versions 9.11.0, 9.9.2, 9.5.8, 9.10.1, and 9.8.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-42497.
In Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 a medium severity vulnerability CVE-2024-8071 was detected. This vulnerability allows attackers with certain permissions to elevate their privileges to become a system administrator, giving them full control over the Mattermost system. To fix this issue, users should upgrade Mattermost to versions 9.11.0, 9.9.2, 9.5.8, 9.10.1 and 9.8.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8071.
Read more Communication
In Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, and 9.8.x <= 9.8.2 a medium severity vulnerability CVE-2024-32939 was detected. When shared channels are enabled, remote users’ original email addresses stored in user properties are not redacted, even when email visibility is configured to be hidden on the local server. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-32939.
Read more Communication
In Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 a medium severity vulnerability CVE-2024-43813 was detected. The system lacks proper access controls, letting any authenticated user, including guests, mark any channel in any team as read for any user. This can lead to unauthorized changes in user notifications and disrupt the user experience. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-43813.
Read more Communication
In Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 a medium severity vulnerability CVE-2024-43780 was detected. This vulnerability allows a guest user with read access to upload files to a channel. To fix this issue, users must upgrade Mattermost to versions 9.5.8, 9.10.1, 9.9.2, 9.8.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-43780/.
Read more Communication