Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2024-36241

/playbook add slash command allows viewing arbitrary post contents

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents via the /playbook add slash command

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 9.5.0 to ≤ 9.5.3affected
  • 9.6.0 to ≤ 9.6.1affected
  • 8.1.0 to ≤ 8.1.12affected
  • 9.7.0unaffected
  • 9.5.4unaffected
  • 9.6.2unaffected
  • 8.1.13unaffected

References