CVE-2024-29215

Slash commands run in channel without channel membership via playbook task commands

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash command in a channel they are not a member of via linking a playbook run to that channel and running a slash command as a playbook task command.

Las versiones de Mattermost 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 no aplican el control de acceso adecuado que permite a un usuario ejecutar un comando de barra diagonal en un canal del que no son miembros vinculando una ejecución del libro de jugadas a ese canal y ejecutando un comando de barra diagonal como un comando de tarea del libro de jugadas.

*Credits: Juho Nurminen

CVSS Scores

Mattermost, Inc.v3.1 4.3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-23 CVE Reserved
2024-05-26 CVE Published
2024-05-27 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-284: Improper Access Control

CAPEC

References (1)

URL	Tag	Source
https://mattermost.com/security-updates

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mattermost Search vendor "Mattermost"		Mattermost Search vendor "Mattermost" for product "Mattermost"				>= 9.5.0 <= 9.5.3 Search vendor "Mattermost" for product "Mattermost" and version " >= 9.5.0 <= 9.5.3"		en		Affected
Mattermost Search vendor "Mattermost"		Mattermost Search vendor "Mattermost" for product "Mattermost"				>= 9.7.0 <= 9.7.1 Search vendor "Mattermost" for product "Mattermost" and version " >= 9.7.0 <= 9.7.1"		en		Affected
Mattermost Search vendor "Mattermost"		Mattermost Search vendor "Mattermost" for product "Mattermost"				>= 9.6.0 <= 9.6.1 Search vendor "Mattermost" for product "Mattermost" and version " >= 9.6.0 <= 9.6.1"		en		Affected
Mattermost Search vendor "Mattermost"		Mattermost Search vendor "Mattermost" for product "Mattermost"				>= 8.1.0 <= 8.1.12 Search vendor "Mattermost" for product "Mattermost" and version " >= 8.1.0 <= 8.1.12"		en		Affected