Page 3 of 57 results (0.011 seconds)

CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-45843 – Weak SSRF Filtering

https://notcve.org/view.php?id=CVE-2024-45843

Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba. • https://mattermost.com/security-updates • CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-47145 – Unauthorized access on archived channels via file links

https://notcve.org/view.php?id=CVE-2024-47145

Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2024-43780 – Unauthorized channel file upload

https://notcve.org/view.php?id=CVE-2024-43780

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •

CVSS: 6.0EPSS: 0%CPEs: 4EXPL: 0

CVE-2024-42497 – Insufficient permissions checks on teams

https://notcve.org/view.php?id=CVE-2024-42497

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •

CVSS: 2.7EPSS: 0%CPEs: 2EXPL: 0

CVE-2024-40884 – Unauthorized disabling of invite URL

https://notcve.org/view.php?id=CVE-2024-40884

Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •