CVE-2024-36287 - Vulnerability Details - OpenCVE

Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00027.

Key SSVC decision points have not yet been added.

Vendors	Products
Apple	Macos
Mattermost	Mattermost Desktop

Configuration 1 [-]

AND

cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-2213	Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.
Github GHSA	GHSA-xgqm-wp7w-mgg2	Mattermost Desktop App allows for bypassing TCC restrictions on macOS

Fixes

Solution

Update Mattermost Desktop App to versions 5.8.0 or higher.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://mattermost.com/security-updates

History

Wed, 07 Aug 2024 16:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Mattermost Mattermost mattermost Desktop
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:mattermost:mattermost_desktop:::::::: cpe:2.3:o:apple:macos:-:::::::*
Vendors & Products		Apple Apple macos Mattermost Mattermost mattermost Desktop

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2024-06-14T08:39:08.132Z

Updated: 2024-08-02T03:37:03.683Z

Reserved: 2024-06-14T08:22:33.357Z

Link: CVE-2024-36287

Vulnrichment

Updated: 2024-08-02T03:37:03.683Z

NVD

Status : Modified

Published: 2024-06-14T09:15:09.450

Modified: 2024-11-21T09:21:59.527

Link: CVE-2024-36287

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36287", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2024-06-14T08:22:33.357Z", "datePublished": "2024-06-14T08:39:08.132Z", "dateUpdated": "2024-08-02T03:37:03.683Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "5.7.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "5.8.0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Fatih ERDOGAN - @ FeCassie"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.</p>"}], "value": "Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing\u00a0TCC restrictions on macOS."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-06-14T08:39:08.132Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost Desktop App to versions 5.8.0 or higher.</p>"}], "value": "Update Mattermost Desktop App to versions 5.8.0 or higher."}], "source": {"advisory": "MMSA-2024-00326", "defect": ["https://mattermost.atlassian.net/browse/MM-57911"], "discovery": "EXTERNAL"}, "title": "Bypass of TCC restrictions on macOS", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-14T15:36:28.149319Z", "id": "CVE-2024-36287", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-14T15:36:56.846Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:03.683Z"}, "title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:03.683Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36287", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-14T15:36:28.149319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-14T15:36:50.882Z"}}], "cna": {"title": "Bypass of TCC restrictions on macOS", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-57911"], "advisory": "MMSA-2024-00326", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Fatih ERDOGAN - @ FeCassie"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.7.0"}, {"status": "unaffected", "version": "5.8.0"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost Desktop App to versions 5.8.0 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost Desktop App to versions 5.8.0 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing\u00a0TCC restrictions on macOS.", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-06-14T08:39:08.132Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36287", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:37:03.683Z", "dateReserved": "2024-06-14T08:22:33.357Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2024-06-14T08:39:08.132Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD0EF005-DAA6-4271-800A-EDBF6768D148", "versionEndIncluding": "5.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing\u00a0TCC restrictions on macOS."}, {"lang": "es", "value": "Las versiones de la aplicaci\u00f3n de escritorio Mattermost <= 5.7.0 no deshabilitan ciertos indicadores de depuraci\u00f3n de Electron, lo que permite eludir las restricciones de TCC en macOS."}], "id": "CVE-2024-36287", "lastModified": "2024-11-21T09:21:59.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 1.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-14T09:15:09.450", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-693"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}