CVE-2024-2447

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

M

attermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

History

13 Dec 2024, 16:18

Type	Values Removed	Values Added
First Time		Mattermost Mattermost mattermost Server
CWE		CWE-346
CPE		cpe:2.3:a:mattermost:mattermost_server::::::::
References	~~() https://mattermost.com/security-updates -~~	() https://mattermost.com/security-updates - Vendor Advisory

21 Nov 2024, 09:09

Type	Values Removed	Values Added
References	~~() https://mattermost.com/security-updates -~~	() https://mattermost.com/security-updates -

Information

Published : 2024-04-05 09:15

Updated : 2024-12-13 16:18

NVD link : CVE-2024-2447

Mitre link : CVE-2024-2447

CVE.ORG link : CVE-2024-2447

JSON object : View

Products Affected

mattermost_server

CWE

CWE-284

Improper Access Control

CWE-346

Origin Validation Error

{"id": "CVE-2024-2447", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-04-05T09:15:09.860", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.\n\n"}, {"lang": "es", "value": "Las versiones de Mattermost 8.1.x anteriores a 8.1.11, 9.3.x anteriores a 9.3.3, 9.4.x anteriores a 9.4.4 y 9.5.x anteriores a 9.5.2 no logran autenticar la fuente de ciertos tipos de acciones de publicaci\u00f3n, lo que permite una atacante autenticado para crear publicaciones como otros usuarios a trav\u00e9s de una acci\u00f3n de publicaci\u00f3n manipulada."}], "lastModified": "2024-12-13T16:18:47.833", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66FEDCF9-277A-4D60-8A28-948068A10F91", "versionEndExcluding": "8.1.11", "versionStartIncluding": "8.1.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4A105B6-CFF8-4FF0-A70D-F3C390AE0FAD", "versionEndExcluding": "9.3.3", "versionStartIncluding": "9.3.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "600DCF59-6535-484C-9DDC-E33834B90B25", "versionEndExcluding": "9.4.4", "versionStartIncluding": "9.4.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A768D77-9FF0-4C1B-81B0-AD2187832E62", "versionEndExcluding": "9.5.2", "versionStartIncluding": "9.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}