CVE-2024-29215

Summary

Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash command in a channel they are not a member of via linking a playbook run to that channel and running a slash command as a playbook task command.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost9.5.0 <= 9.5.3affected
MattermostMattermost9.7.0 <= 9.7.1affected
MattermostMattermost9.6.0 <= 9.6.1affected
MattermostMattermost8.1.0 <= 8.1.12affected
MattermostMattermost9.8.0unaffected
MattermostMattermost9.5.4unaffected
MattermostMattermost9.7.2unaffected
MattermostMattermost9.6.2unaffected
MattermostMattermost8.1.13unaffected

Weaknesses

  • CWE-284: CWE-284: Improper Access Control

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References