CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-32939 – Email addresses of remote users visible in props regardless of server settings
https://notcve.org/view.php?id=CVE-2024-32939
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server." Las versiones de Mattermost 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, cuando los canales compartidos están habilitados, no se pueden redactar las direcciones de correo electrónico originales de los usuarios remotos almacenadas en las propiedades del usuario cuando las direcciones de correo electrónico están configuradas para no ser visibles en el servidor local. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 4.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-39836 – Munged email address used for password resets and notifications
https://notcve.org/view.php?id=CVE-2024-39836
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails. Las versiones de Mattermost 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 y 9.8.x <= 9.8.2 no garantizan que los usuarios remotos/sintéticos no puedan crear sesiones ni restablecer contraseñas, que permite que las direcciones de correo electrónico eliminadas, creadas por canales compartidos, se utilicen para recibir notificaciones por correo electrónico y restablecer contraseñas, cuando sean correos electrónicos válidos y funcionales. • https://mattermost.com/security-updates • CWE-693: Protection Mechanism Failure •
CVSS: 2.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-41926 – Malicious remote can claim that a user was synced from another remote
https://notcve.org/view.php?id=CVE-2024-41926
Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 4.1EPSS: 0%CPEs: 4EXPL: 0CVE-2024-41162 – Malicious remote can make an arbitrary local channel read-only
https://notcve.org/view.php?id=CVE-2024-41162
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-41144 – Malicious remote can create/update/delete arbitrary posts in arbitrary channels
https://notcve.org/view.php?id=CVE-2024-41144
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled, which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels • https://mattermost.com/security-updates • CWE-284: Improper Access Control •