{"id":"CVE-2024-1942","state":"PUBLISHED","title":"Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authen","description":"Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.\n\n","publishedAt":"2024-02-29T10:41:38.292Z","updatedAt":"2024-08-12T13:16:32.143Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"Mattermost"},"assigner":"Mattermost","products":["Mattermost Mattermost"],"affected":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"9.2.0","status":"affected","lessThanOrEqual":"9.2.4","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThanOrEqual":"8.1.8","versionType":"semver"},{"version":"9.3.0","status":"affected"},{"version":"9.4","status":"unaffected"},{"version":"9.3.1","status":"unaffected"},{"version":"9.2.5","status":"unaffected"},{"version":"8.1.9","status":"unaffected"}]}],"references":["https://mattermost.com/security-updates"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1942.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1942","state":"PUBLISHED","datePublished":"2024-02-29T10:41:38.292Z","dateUpdated":"2024-08-12T13:16:32.143Z","assignerShortName":"Mattermost","assignerOrgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateReserved":"2024-02-27T18:10:31.220Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.\n\n"}],"affected":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"9.2.0","status":"affected","lessThanOrEqual":"9.2.4","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThanOrEqual":"8.1.8","versionType":"semver"},{"version":"9.3.0","status":"affected"},{"version":"9.4","status":"unaffected"},{"version":"9.3.1","status":"unaffected"},{"version":"9.2.5","status":"unaffected"},{"version":"8.1.9","status":"unaffected"}]}],"references":[{"url":"https://mattermost.com/security-updates"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mattermost","orgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateUpdated":"2024-02-29T10:41:38.292Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Juho Nurminen"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Update Mattermost Server to versions 9.4, 9.3.1, 9.2.5, 8.1.9 or higher.</p>"}],"value":"Update Mattermost Server to versions 9.4, 9.3.1, 9.2.5, 8.1.9 or higher.\n\n"}],"source":{"advisory":"MMSA-2023-00283","defect":["https://mattermost.atlassian.net/browse/MM-55495"],"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://mattermost.com/security-updates","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:56:22.628Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-12T13:16:00.855584Z","id":"CVE-2024-1942","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-12T13:16:32.143Z"}}]}}}