CVE-2024-39353

Summary

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker with access to the audit logs to read message contents.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost9.8.0affected
MattermostMattermost9.5.0 <= 9.5.5affected
MattermostMattermost9.9.0unaffected
MattermostMattermost9.8.1unaffected
MattermostMattermost9.5.6unaffected

Weaknesses

  • CWE-200: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References