CVE-2024-39836

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost::::::::
	cpe:2.3:a:mattermost:mattermost::::::::
	cpe:2.3:a:mattermost:mattermost::::::::
	cpe:2.3:a:mattermost:mattermost::::::::

History

23 Aug 2024, 16:16

Type	Values Removed	Values Added
CPE		cpe:2.3:a:mattermost:mattermost::::::::
First Time		Mattermost Mattermost mattermost
CVSS	v2 : ~~unknown~~ v3 : ~~4.8~~	v2 : unknown v3 : 6.5
CWE		NVD-CWE-noinfo
References	~~() https://mattermost.com/security-updates -~~	() https://mattermost.com/security-updates - Vendor Advisory

22 Aug 2024, 12:48

Type	Values Removed	Values Added
Summary		(es) Las versiones de Mattermost 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 y 9.8.x <= 9.8.2 no garantizan que los usuarios remotos/sintéticos no puedan crear sesiones ni restablecer contraseñas, que permite que las direcciones de correo electrónico eliminadas, creadas por canales compartidos, se utilicen para recibir notificaciones por correo electrónico y restablecer contraseñas, cuando sean correos electrónicos válidos y funcionales.

22 Aug 2024, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-22 07:15

Updated : 2024-08-23 16:16

NVD link : CVE-2024-39836

Mitre link : CVE-2024-39836

CVE.ORG link : CVE-2024-39836

JSON object : View

Products Affected

mattermost

mattermost

CWE

NVD-CWE-noinfo CWE-693

Protection Mechanism Failure

{"id": "CVE-2024-39836", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "published": "2024-08-22T07:15:03.960", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows\u00a0the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when\u00a0they are valid, functional emails."}, {"lang": "es", "value": "Las versiones de Mattermost 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 y 9.8.x <= 9.8.2 no garantizan que los usuarios remotos/sint\u00e9ticos no puedan crear sesiones ni restablecer contrase\u00f1as, que permite que las direcciones de correo electr\u00f3nico eliminadas, creadas por canales compartidos, se utilicen para recibir notificaciones por correo electr\u00f3nico y restablecer contrase\u00f1as, cuando sean correos electr\u00f3nicos v\u00e1lidos y funcionales."}], "lastModified": "2024-08-23T16:16:18.757", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FEEA8D7-745A-49FF-8B01-CA0D1D820D48", "versionEndExcluding": "9.5.8", "versionStartIncluding": "9.5.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B9B4EAB-A618-4823-BECD-0BFD3D76A9D2", "versionEndExcluding": "9.8.3", "versionStartIncluding": "9.8.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A445A478-E185-49DF-8CDC-F42BBF8577D4", "versionEndExcluding": "9.9.2", "versionStartIncluding": "9.9.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CA40F21-914D-4891-A578-02E6F35FE249", "versionEndExcluding": "9.10.1", "versionStartIncluding": "9.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}