Page 2 of 55 results (0.003 seconds)

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-9155 – Insufficient Authorization On Unlinked Channel Files

https://notcve.org/view.php?id=CVE-2024-9155

Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of. • https://mattermost.com/security-updates • CWE-863: Incorrect Authorization •

CVSS: 3.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2024-47003 – DoS via non-string message using permalink embed

https://notcve.org/view.php?id=CVE-2024-47003

Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend. • https://mattermost.com/security-updates • CWE-400: Uncontrolled Resource Consumption •

CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0

CVE-2024-42406 – Unauthorized access on archived channels

https://notcve.org/view.php?id=CVE-2024-42406

Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •

CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-45843 – Weak SSRF Filtering

https://notcve.org/view.php?id=CVE-2024-45843

Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba. • https://mattermost.com/security-updates • CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-47145 – Unauthorized access on archived channels via file links

https://notcve.org/view.php?id=CVE-2024-47145

Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •