DeutschShown in its original language — a full translation is planned for a future version.
Mattermost Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
view advisory published 2024-08-29
Ein Angreifer kann mehrere Schwachstellen im Mattermost Server ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
01
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-9155US | —OT elevated | — | ||
Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view the… | ||||
| CVE-2024-47145US | medium4.3 | — | ||
Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and fil… | ||||
| CVE-2024-47003US | medium6.5 | — | ||
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as… | ||||
| CVE-2024-45843US | medium5.4 | — | ||
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Ma… | ||||
| CVE-2024-42406US | medium5.4 | — | ||
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allo… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan