CVE-2024-32045
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Exploitability: 1.6 / Impact: 4.2
Source: responsibledisclosure@mattermost.com (Secondary)
Description
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of.
Affected (3)
Products: Mattermost: Mattermost Server
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 8.1.0 to 8.1.13 |
Related CWEs
CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
References (2)
Timeline
No history available yet.