{"id":"CVE-2024-41144","published":"2024-08-01T14:05:08Z","modified":"2024-08-05T16:58:34Z","title":"Malicious remote can create/update/delete arbitrary posts in arbitrary channels","vendor":"Mattermost","product":"Mattermost","tier":"tail","description":{"text":"Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled,  which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels","provenance":"source","from":"CVE.org"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00362,"percentile":0.29873,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://mattermost.com/security-updates","tags":[]}],"priority":{"score":9.8,"factors":[{"name":"EPSS percentile","points":5.97},{"name":"CVSS severity","points":3.85}]},"vendorSlug":"mattermost","affectedVersions":[{"vendor":"Mattermost","product":"Mattermost","versions":["9.9.0",">= 9.5.0, <= 9.5.6",">= 9.7.0, <= 9.7.5",">= 9.8.0, <= 9.8.1"]}],"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","vulnerableRanges":[">=9.5.0, <9.5.7",">=9.7.0, <9.7.6",">=9.8.0, <9.8.2",">=9.9.0, <9.9.1","<8.0.0-20240619142046-8181a9ddffc0","all versions"],"patched":["9.5.7","9.7.6","9.8.2","9.9.1","8.0.0-20240619142046-8181a9ddffc0"],"from":["GHSA-vg67-chm7-8m3j","GO-2024-3023"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost","vulnerableRanges":["<5.3.2-0.20240619142046-8181a9ddffc0"],"patched":["5.3.2-0.20240619142046-8181a9ddffc0"],"from":["GHSA-vg67-chm7-8m3j"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":[">=9.5.0+incompatible, <9.5.7+incompatible",">=9.7.0+incompatible, <9.7.6+incompatible",">=9.8.0+incompatible, <9.8.2+incompatible",">=9.9.0+incompatible, <9.9.1+incompatible"],"patched":["9.5.7+incompatible","9.7.6+incompatible","9.8.2+incompatible","9.9.1+incompatible"],"from":["GO-2024-3023"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v5","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-3023"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v6","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-3023"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2662","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mattermost-cve-2024-39837","packageHistory":[{"cve":"CVE-2024-39832","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-39837","published":"2024-08-01","fixed":"9.9.1","kev":false,"link":{"from":"CVE-2024-41144","to":"CVE-2024-39837","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost/server/v8","fromFixed":"8.0.0-20240619142046-8181a9ddffc0","toFixed":"8.0.0-20240626164322-c758cecaf30c","daysApart":0},{"kind":"similar","provenance":"machine","score":0.59,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2024-39839","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-41144","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-41162","published":"2024-08-01","fixed":"9.9.1","kev":false,"link":{"from":"CVE-2024-41144","to":"CVE-2024-41162","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost","fromFixed":"5.3.2-0.20240619142046-8181a9ddffc0","toFixed":"5.3.2-0.20240628125750-70b218839fa7","daysApart":0},{"kind":"similar","provenance":"machine","score":0.47,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2024-41926","published":"2024-08-01","fixed":"9.9.1","kev":false,"link":{"from":"CVE-2024-41926","to":"CVE-2024-41144","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost/server/v8","fromFixed":"8.0.0-20240604093018-5114c3b7cdb8","toFixed":"8.0.0-20240619142046-8181a9ddffc0","daysApart":0},{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost","fromFixed":"5.3.2-0.20240604093018-5114c3b7cdb8","toFixed":"5.3.2-0.20240619142046-8181a9ddffc0","daysApart":0},{"kind":"similar","provenance":"machine","score":0.31,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2024-32939","published":"2024-08-22","fixed":"9.10.1","kev":false}],"package":"Go:github.com/mattermost/mattermost/server/v8"}}