CVE-2024-39807

Summary

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to retrieve the channel IDs of archived or restored channels.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost9.8.0affected
MattermostMattermost9.5.0 <= 9.5.5affected
MattermostMattermost9.9.0unaffected
MattermostMattermost9.8.1unaffected
MattermostMattermost9.5.6unaffected

Weaknesses

  • CWE-200: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References