CVE-2024-36255 - Vulnerability Details - OpenCVE

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00088.

Key SSVC decision points have not yet been added.

Vendors	Products
Mattermost	Mattermost Mattermost Server

Configuration 1 [-]

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Mattermost	Mattermost

Fixes

Solution

Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://mattermost.com/security-updates

History

Tue, 30 Sep 2025 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mattermost mattermost Server
CPEs		cpe:2.3:a:mattermost:mattermost_server::::::::
Vendors & Products		Mattermost mattermost Server

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2024-05-26T13:32:56.087Z

Updated: 2024-08-02T03:37:03.667Z

Reserved: 2024-05-23T10:57:59.907Z

Link: CVE-2024-36255

Vulnrichment

Updated: 2024-08-02T03:37:03.667Z

NVD

Status : Analyzed

Published: 2024-05-26T14:15:10.060

Modified: 2025-09-30T15:29:54.477

Link: CVE-2024-36255

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-07-12T15:42:39Z

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36255", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2024-05-23T10:57:59.907Z", "datePublished": "2024-05-26T13:32:56.087Z", "dateUpdated": "2024-08-02T03:37:03.667Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "9.5.3", "status": "affected", "version": "9.5.0", "versionType": "semver"}, {"lessThanOrEqual": "9.6.1", "status": "affected", "version": "9.6.0", "versionType": "semver"}, {"lessThanOrEqual": "8.1.12", "status": "affected", "version": "8.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "9.7.0"}, {"status": "unaffected", "version": "9.5.4"}, {"status": "unaffected", "version": "9.6.2"}, {"status": "unaffected", "version": "8.1.13"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Juho Nurminen"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel.</p>"}], "value": "Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-05-26T13:32:56.087Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher.</p>"}], "value": "Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher."}], "source": {"advisory": "MMSA-2024-00301", "defect": ["https://mattermost.atlassian.net/browse/MM-56346"], "discovery": "INTERNAL"}, "title": "Post actions can run playbook checklist task commands", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36255", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T16:55:50.413186Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mattermost:mattermost:9.5.3:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "9.5.x", "versionType": "custom", "lessThanOrEqual": "9.5.3"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:9.6.1:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "9.6.x", "versionType": "custom", "lessThanOrEqual": "9.6.1"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:8.1.12:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "8.1.x", "versionType": "custom", "lessThanOrEqual": "8.1.12"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:47:35.787Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:03.667Z"}, "title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:03.667Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36255", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T16:55:50.413186Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mattermost:mattermost:9.5.3:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "9.5.x", "versionType": "custom", "lessThanOrEqual": "9.5.3"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:9.6.1:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "9.6.x", "versionType": "custom", "lessThanOrEqual": "9.6.1"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:8.1.12:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "8.1.x", "versionType": "custom", "lessThanOrEqual": "8.1.12"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T16:57:59.525Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Post actions can run playbook checklist task commands", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-56346"], "advisory": "MMSA-2024-00301", "discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Juho Nurminen"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "9.5.0", "versionType": "semver", "lessThanOrEqual": "9.5.3"}, {"status": "affected", "version": "9.6.0", "versionType": "semver", "lessThanOrEqual": "9.6.1"}, {"status": "affected", "version": "8.1.0", "versionType": "semver", "lessThanOrEqual": "8.1.12"}, {"status": "unaffected", "version": "9.7.0"}, {"status": "unaffected", "version": "9.5.4"}, {"status": "unaffected", "version": "9.6.2"}, {"status": "unaffected", "version": "8.1.13"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel.", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-05-26T13:32:56.087Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36255", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:37:03.667Z", "dateReserved": "2024-05-23T10:57:59.907Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2024-05-26T13:32:56.087Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "47448305-8E05-4AEE-9E7B-D52AC86C7370", "versionEndExcluding": "8.1.13", "versionStartIncluding": "8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "73F3450F-7A4F-450D-BC68-E726D347636F", "versionEndExcluding": "9.5.4", "versionStartIncluding": "9.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3E36367-4F29-45EE-BCF6-CDAA8E599E85", "versionEndExcluding": "9.6.2", "versionStartIncluding": "9.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel."}, {"lang": "es", "value": "Las versiones de Mattermost 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 y 8.1.x <= 8.1.12 no realizan una validaci\u00f3n de entrada adecuada en las acciones posteriores, lo que permite a un atacante ejecutar un comando de tarea de lista de verificaci\u00f3n del libro de jugadas como otro usuario creando y compartiendo una acci\u00f3n de publicaci\u00f3n enga\u00f1osa que ejecuta inesperadamente un comando de barra diagonal en alg\u00fan canal arbitrario."}], "id": "CVE-2024-36255", "lastModified": "2025-09-30T15:29:54.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}, "published": "2024-05-26T14:15:10.060", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}