Page 2 of 9 results (0.004 seconds)

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-50052 – Arbitrary post deletion via Playbooks /ignore-thread endpoint

https://notcve.org/view.php?id=CVE-2024-50052

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post. Las versiones de Mattermost 9.10.x &lt;= 9.10.2, 9.11.x &lt;= 9.11.1, 9.5.x &lt;= 9.5.9 no verifican que el origen del mensaje en una acción de integración coincida con los metadatos de la publicación original, lo que permite que un usuario autenticado elimine una publicación arbitraria. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •

CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0

CVE-2024-10214 – Incorrect Session Creation with Desktop SSO

https://notcve.org/view.php?id=CVE-2024-10214

Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings. • https://mattermost.com/security-updates • CWE-303: Incorrect Implementation of Authentication Algorithm •

CVSS: 3.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2024-47003 – DoS via non-string message using permalink embed

https://notcve.org/view.php?id=CVE-2024-47003

Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend. • https://mattermost.com/security-updates • CWE-400: Uncontrolled Resource Consumption •

CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0

CVE-2024-42406 – Unauthorized access on archived channels

https://notcve.org/view.php?id=CVE-2024-42406

Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •