CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-42406 – Unauthorized access on archived channels
https://notcve.org/view.php?id=CVE-2024-42406
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45843 – Weak SSRF Filtering
https://notcve.org/view.php?id=CVE-2024-45843
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba. • https://mattermost.com/security-updates • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47145 – Unauthorized access on archived channels via file links
https://notcve.org/view.php?id=CVE-2024-47145
Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 2.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45835 – Insufficient Electron Fuses Configuration
https://notcve.org/view.php?id=CVE-2024-45835
Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access. • https://mattermost.com/security-updates • CWE-693: Protection Mechanism Failure •
CVSS: 3.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39772 – Silent Desktop Screenshot Capture
https://notcve.org/view.php?id=CVE-2024-39772
Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •