CVSS: 4.1EPSS: 0%CPEs: 4EXPL: 0CVE-2024-41162 – Malicious remote can make an arbitrary local channel read-only
https://notcve.org/view.php?id=CVE-2024-41162
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-41144 – Malicious remote can create/update/delete arbitrary posts in arbitrary channels
https://notcve.org/view.php?id=CVE-2024-41144
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled, which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-39839 – Remote username set to an arbitrary string by remote user
https://notcve.org/view.php?id=CVE-2024-39839
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the local server as long as the user hadn't been synced before. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 3.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-39837 – Malicious remote can create arbitrary channels
https://notcve.org/view.php?id=CVE-2024-39837
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-39832 – Permanently local data deletion by malicious remote
https://notcve.org/view.php?id=CVE-2024-39832
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently delete local data by abusing dangerous error handling, when share channels were enabled. • https://mattermost.com/security-updates • CWE-754: Improper Check for Unusual or Exceptional Conditions •