CVE-2024-42497 - OpenCVE

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Mattermost	Mattermost

No data.

No data.

References

Link	Providers
https://mattermost.com/security-updates
https://nvd.nist.gov/vuln/detail/CVE-2024-42497
https://www.cve.org/CVERecord?id=CVE-2024-42497

History

Thu, 22 Aug 2024 23:30:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2024-42497 https://www.cve.org/CVERecord?id=CVE-2024-42497
Metrics	threat_severity `None`	threat_severity `Low`

Thu, 22 Aug 2024 16:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mattermost Mattermost mattermost
CPEs		cpe:2.3:a:mattermost:mattermost::::::::
Vendors & Products		Mattermost Mattermost mattermost
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 22 Aug 2024 15:30:00 +0000

Type	Values Removed	Values Added
Description		Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.
Title		Insufficient permissions checks on teams
Weaknesses		CWE-284
References		https://mattermost.com/security-updates
Metrics		cvssV3_1 `{'score': 6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2024-08-22T15:17:11.468Z

Updated: 2024-08-22T15:31:45.824Z

Reserved: 2024-08-16T17:27:00.329Z

Link: CVE-2024-42497

Vulnrichment

Updated: 2024-08-22T15:31:20.494Z

NVD

Status : Awaiting Analysis

Published: 2024-08-22T16:15:09.330

Modified: 2024-08-23T16:18:28.547

Link: CVE-2024-42497

Redhat

Severity : Low

Publid Date: 2024-08-22T16:15:09Z

Links: CVE-2024-42497 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42497", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2024-08-16T17:27:00.329Z", "datePublished": "2024-08-22T15:17:11.468Z", "dateUpdated": "2024-08-22T15:31:45.824Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "9.9.1", "status": "affected", "version": "9.9.0", "versionType": "semver"}, {"lessThanOrEqual": "9.5.7", "status": "affected", "version": "9.5.0", "versionType": "semver"}, {"status": "affected", "version": "9.10.0"}, {"lessThanOrEqual": "9.8.2", "status": "affected", "version": "9.8.0", "versionType": "semver"}, {"status": "unaffected", "version": "9.11.0"}, {"status": "unaffected", "version": "9.9.2"}, {"status": "unaffected", "version": "9.5.8"}, {"status": "unaffected", "version": "9.10.1"}, {"status": "unaffected", "version": "9.8.3"}]}], "credits": [{"lang": "en", "type": "finder", "value": "BhaRat (hackit_bharat)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.<br></p>"}], "value": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-08-22T15:17:11.468Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost to versions 9.11.0, 9.9.2, 9.5.8, 9.10.1, 9.8.3 or higher.</p>"}], "value": "Update Mattermost to versions 9.11.0, 9.9.2, 9.5.8, 9.10.1, 9.8.3 or higher."}], "source": {"advisory": "MMSA-2024-00353", "defect": ["https://mattermost.atlassian.net/browse/MM-58547"], "discovery": "EXTERNAL"}, "title": "Insufficient permissions checks on teams", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "mattermost", "product": "mattermost", "cpes": ["cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "9.9.0", "status": "affected", "lessThanOrEqual": "9.9.1", "versionType": "semver"}, {"version": "9.5.0", "status": "affected", "lessThanOrEqual": "9.5.7", "versionType": "semver"}, {"version": "9.10.0", "status": "affected"}, {"version": "9.8.0", "status": "affected", "lessThanOrEqual": "9.8.2", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-22T15:27:30.908684Z", "id": "CVE-2024-42497", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-22T15:31:45.824Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42497", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-22T15:27:30.908684Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "9.9.0", "versionType": "semver", "lessThanOrEqual": "9.9.1"}, {"status": "affected", "version": "9.5.0", "versionType": "semver", "lessThanOrEqual": "9.5.7"}, {"status": "affected", "version": "9.10.0"}, {"status": "affected", "version": "9.8.0", "versionType": "semver", "lessThanOrEqual": "9.8.2"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-22T15:31:20.494Z"}}], "cna": {"title": "Insufficient permissions checks on teams", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-58547"], "advisory": "MMSA-2024-00353", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "BhaRat (hackit_bharat)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "9.9.0", "versionType": "semver", "lessThanOrEqual": "9.9.1"}, {"status": "affected", "version": "9.5.0", "versionType": "semver", "lessThanOrEqual": "9.5.7"}, {"status": "affected", "version": "9.10.0"}, {"status": "affected", "version": "9.8.0", "versionType": "semver", "lessThanOrEqual": "9.8.2"}, {"status": "unaffected", "version": "9.11.0"}, {"status": "unaffected", "version": "9.9.2"}, {"status": "unaffected", "version": "9.5.8"}, {"status": "unaffected", "version": "9.10.1"}, {"status": "unaffected", "version": "9.8.3"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 9.11.0, 9.9.2, 9.5.8, 9.10.1, 9.8.3 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost to versions 9.11.0, 9.9.2, 9.5.8, 9.10.1, 9.8.3 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.<br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-08-22T15:17:11.468Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42497", "state": "PUBLISHED", "dateUpdated": "2024-08-22T15:31:45.824Z", "dateReserved": "2024-08-16T17:27:00.329Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2024-08-22T15:17:11.468Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "mattermost: permission enforcing failure allows a user with systems manager role with read-only access to teams to perform write operations on teams", "id": "2307317", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2307317"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-284", "details": ["Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.", "A flaw was found in the mattermost package where it fails to properly enforce permissions. This flaw allows a user with a system manager role and read-only access to perform write operations."], "name": "CVE-2024-42497", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Fix deferred", "package_name": "advanced-cluster-security/rhacs-central-db-rhel8", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Fix deferred", "package_name": "advanced-cluster-security/rhacs-main-rhel8", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Fix deferred", "package_name": "advanced-cluster-security/rhacs-rhel8-operator", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Fix deferred", "package_name": "advanced-cluster-security/rhacs-roxctl-rhel8", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Fix deferred", "package_name": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Fix deferred", "package_name": "advanced-cluster-security/rhacs-scanner-v4-rhel8", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-5-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-6-dashboard-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Fix deferred", "package_name": "openshift-gitops-1/dex-rhel8", "product_name": "Red Hat OpenShift GitOps"}], "public_date": "2024-08-22T16:15:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-42497\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-42497\nhttps://mattermost.com/security-updates"], "statement": "This vulnerability was classified with a 'Low' severity by the Red Hat Product Security team as the attacker needs to have high privileges to exploit this issue.", "threat_severity": "Low"}