CVE-2024-36287 - Vulnerability Details - OpenCVE

Description

Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.

Published: 2024-06-14

Score: 3.8 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mattermost

Mattermost

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.7.0
`5.8.0`	unaffected	—

Configuration 1 [-]

AND

cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

Vendor Solution

Update Mattermost Desktop App to versions 5.8.0 or higher.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2024-2213	Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.
Github GHSA	GHSA-xgqm-wp7w-mgg2	Mattermost Desktop App allows for bypassing TCC restrictions on macOS

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00028.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://mattermost.com/security-updates

History

Wed, 07 Aug 2024 16:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Mattermost Mattermost mattermost Desktop
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:mattermost:mattermost_desktop:::::::: cpe:2.3:o:apple:macos:-:::::::*
Vendors & Products		Apple Apple macos Mattermost Mattermost mattermost Desktop

Subscriptions

Apple Macos

Mattermost Mattermost Desktop

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2024-06-14T08:39:08.132Z

Updated: 2024-08-02T03:37:03.683Z

Reserved: 2024-06-14T08:22:33.357Z

Link: CVE-2024-36287

Vulnrichment

Updated: 2024-08-02T03:37:03.683Z

NVD

Status : Modified

Published: 2024-06-14T09:15:09.450

Modified: 2024-11-21T09:21:59.527

Link: CVE-2024-36287

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36287", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2024-06-14T08:22:33.357Z", "datePublished": "2024-06-14T08:39:08.132Z", "dateUpdated": "2024-08-02T03:37:03.683Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "5.7.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "5.8.0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Fatih ERDOGAN - @ FeCassie"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.</p>"}], "value": "Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing\u00a0TCC restrictions on macOS."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-06-14T08:39:08.132Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost Desktop App to versions 5.8.0 or higher.</p>"}], "value": "Update Mattermost Desktop App to versions 5.8.0 or higher."}], "source": {"advisory": "MMSA-2024-00326", "defect": ["https://mattermost.atlassian.net/browse/MM-57911"], "discovery": "EXTERNAL"}, "title": "Bypass of TCC restrictions on macOS", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-14T15:36:28.149319Z", "id": "CVE-2024-36287", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-14T15:36:56.846Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:03.683Z"}, "title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:03.683Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36287", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-14T15:36:28.149319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-14T15:36:50.882Z"}}], "cna": {"title": "Bypass of TCC restrictions on macOS", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-57911"], "advisory": "MMSA-2024-00326", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Fatih ERDOGAN - @ FeCassie"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.7.0"}, {"status": "unaffected", "version": "5.8.0"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost Desktop App to versions 5.8.0 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost Desktop App to versions 5.8.0 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing\u00a0TCC restrictions on macOS.", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-06-14T08:39:08.132Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36287", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:37:03.683Z", "dateReserved": "2024-06-14T08:22:33.357Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2024-06-14T08:39:08.132Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD0EF005-DAA6-4271-800A-EDBF6768D148", "versionEndIncluding": "5.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing\u00a0TCC restrictions on macOS."}, {"lang": "es", "value": "Las versiones de la aplicaci\u00f3n de escritorio Mattermost <= 5.7.0 no deshabilitan ciertos indicadores de depuraci\u00f3n de Electron, lo que permite eludir las restricciones de TCC en macOS."}], "id": "CVE-2024-36287", "lastModified": "2024-11-21T09:21:59.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 1.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-14T09:15:09.450", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-693"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}