Skip to content
CVE PROGRAM SOURCE RECORD2.6 Low

CVE-2024-32945

LaTeX post content manipulation via renderer state leak across contexts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a LateX post, by creating another post with specific macro definitions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 0 to ≤ 2.16.0affected
  • 2.17.0unaffected

References