CVE-2024-31859

Member promoted to channel admin via playbooks run linking to channel

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin

Las versiones 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 y 8.1.x <= 8.1.12 de Mattermost no realizan las comprobaciones de autorización adecuadas, lo que permite que un miembro que ejecuta un libro de estrategias en un canal existente sea promovido a un administrador del canal

*Credits: BhaRat (hackit_bharat)

CVSS Scores

Mattermost, Inc.v3.1 4.3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-23 CVE Reserved
2024-05-26 CVE Published
2024-05-27 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-284: Improper Access Control

CAPEC

References (1)

URL	Tag	Source
https://mattermost.com/security-updates

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mattermost Search vendor "Mattermost"		Mattermost Search vendor "Mattermost" for product "Mattermost"				>= 9.5.0 <= 9.5.3 Search vendor "Mattermost" for product "Mattermost" and version " >= 9.5.0 <= 9.5.3"		en		Affected
Mattermost Search vendor "Mattermost"		Mattermost Search vendor "Mattermost" for product "Mattermost"				>= 9.6.0 <= 9.6.1 Search vendor "Mattermost" for product "Mattermost" and version " >= 9.6.0 <= 9.6.1"		en		Affected
Mattermost Search vendor "Mattermost"		Mattermost Search vendor "Mattermost" for product "Mattermost"				>= 8.1.0 <= 8.1.12 Search vendor "Mattermost" for product "Mattermost" and version " >= 8.1.0 <= 8.1.12"		en		Affected