// For flags

CVE-2024-42000

Unauthorized Access to view channels' details

Severity Score

2.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels  which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels.

*Credits: othman (3thm4n)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-11-05 CVE Reserved
  • 2024-11-09 CVE Published
  • 2024-11-12 CVE Updated
  • 2024-11-15 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-863: Incorrect Authorization
CAPEC
References (1)
URL Tag Source
https://mattermost.com/security-updates
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mattermost
Search vendor "Mattermost"
 Mattermost
Search vendor "Mattermost" for product "Mattermost"
 >= 9.10.0 <= 9.10.2
Search vendor "Mattermost" for product "Mattermost" and version " >= 9.10.0 <= 9.10.2"
en
Affected
Mattermost
Search vendor "Mattermost"
 Mattermost
Search vendor "Mattermost" for product "Mattermost"
 >= 9.11.0 <= 9.11.1
Search vendor "Mattermost" for product "Mattermost" and version " >= 9.11.0 <= 9.11.1"
en
Affected
Mattermost
Search vendor "Mattermost"
 Mattermost
Search vendor "Mattermost" for product "Mattermost"
 >= 9.5.0 <= 9.5.9
Search vendor "Mattermost" for product "Mattermost" and version " >= 9.5.0 <= 9.5.9"
en
Affected
Mattermost
Search vendor "Mattermost"
 Mattermost
Search vendor "Mattermost" for product "Mattermost"
 10.0.0
Search vendor "Mattermost" for product "Mattermost" and version "10.0.0"
en
Affected