CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-10214 – Incorrect Session Creation with Desktop SSO
https://notcve.org/view.php?id=CVE-2024-10214
Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings. • https://mattermost.com/security-updates • CWE-303: Incorrect Implementation of Authentication Algorithm •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-9155 – Insufficient Authorization On Unlinked Channel Files
https://notcve.org/view.php?id=CVE-2024-9155
Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of. • https://mattermost.com/security-updates • CWE-863: Incorrect Authorization •
CVSS: 3.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-47003 – DoS via non-string message using permalink embed
https://notcve.org/view.php?id=CVE-2024-47003
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend. • https://mattermost.com/security-updates • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-42406 – Unauthorized access on archived channels
https://notcve.org/view.php?id=CVE-2024-42406
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-43780 – Unauthorized channel file upload
https://notcve.org/view.php?id=CVE-2024-43780
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •