{"id":"CVE-2024-39837","published":"2024-08-01T14:05:06Z","modified":"2024-08-01T20:47:51Z","title":"Malicious remote can create arbitrary channels","vendor":"Mattermost","product":"Mattermost","tier":"tail","description":{"text":"Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.8,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00283,"percentile":0.20741,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://mattermost.com/security-updates","tags":[]}],"priority":{"score":6.8,"factors":[{"name":"EPSS percentile","points":4.15},{"name":"CVSS severity","points":2.66}]},"vendorSlug":"mattermost","affectedVersions":[{"vendor":"Mattermost","product":"Mattermost","versions":["9.9.0",">= 9.5.0, <= 9.5.6"]}],"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","vulnerableRanges":[">=9.5.0, <9.5.7",">=9.9.0, <9.9.1","<8.0.0-20240626164322-c758cecaf30c","all versions"],"patched":["9.5.7","9.9.1","8.0.0-20240626164322-c758cecaf30c"],"from":["GHSA-vvpg-55p7-5h8w","GO-2024-3032"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":[">=9.9.0, <9.9.1",">=9.5.0, <9.5.7",">=9.5.0+incompatible, <9.5.7+incompatible",">=9.9.0+incompatible, <9.9.1+incompatible"],"patched":["9.9.1","9.5.7","9.5.7+incompatible","9.9.1+incompatible"],"from":["GHSA-vvpg-55p7-5h8w","GO-2024-3032"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v5","vulnerableRanges":["<5.3.2-0.20240626164322-c758cecaf30c","all versions"],"patched":["5.3.2-0.20240626164322-c758cecaf30c"],"from":["GHSA-vvpg-55p7-5h8w","GO-2024-3032"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v6","vulnerableRanges":["<6.0.0-20240626164322-c758cecaf30c","all versions"],"patched":["6.0.0-20240626164322-c758cecaf30c"],"from":["GHSA-vvpg-55p7-5h8w","GO-2024-3032"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2667","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mattermost-cve-2024-39837","packageHistory":[{"cve":"CVE-2025-11776","published":"2025-11-14","fixed":"8.0.0-20250815165020-c8d66301415d","kev":false,"link":{"from":"CVE-2024-39837","to":"CVE-2025-11776","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server/v5","fromFixed":"5.3.2-0.20240626164322-c758cecaf30c","toFixed":"5.3.2-0.20250815165020-c8d66301415d","daysApart":470}]}},{"cve":"CVE-2023-5968","published":"2023-11-06","fixed":"9.0.1","kev":false,"link":{"from":"CVE-2023-5968","to":"CVE-2024-39837","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server/v5","fromFixed":"5.3.2-0.20230825233148-f787fd63368a","toFixed":"5.3.2-0.20240626164322-c758cecaf30c","daysApart":269}]}},{"cve":"CVE-2024-39274","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-39777","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-39832","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-39837","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-39839","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-41144","published":"2024-08-01","fixed":"9.9.1","kev":false,"link":{"from":"CVE-2024-41144","to":"CVE-2024-39837","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost/server/v8","fromFixed":"8.0.0-20240619142046-8181a9ddffc0","toFixed":"8.0.0-20240626164322-c758cecaf30c","daysApart":0},{"kind":"similar","provenance":"machine","score":0.59,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2024-41162","published":"2024-08-01","fixed":"9.9.1","kev":false,"link":{"from":"CVE-2024-39837","to":"CVE-2024-41162","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost/server/v8","fromFixed":"8.0.0-20240626164322-c758cecaf30c","toFixed":"8.0.0-20240628125750-70b218839fa7","daysApart":0},{"kind":"similar","provenance":"machine","score":0.68,"basis":"same product + CWE + description similarity"}]}}],"package":"Go:github.com/mattermost/mattermost/server/v8"}}