CVE-2024-5270

Summary

Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a user requests to switch from SAML to Email. This allows the user to switch their authentication mail from SAML to email and possibly edit personal details that were otherwise non-editable and provided by the SAML provider.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost9.5.0 <= 9.5.3affected
MattermostMattermost9.7.0 <= 9.7.1affected
MattermostMattermost9.6.0 <= 9.6.1affected
MattermostMattermost8.1.0 <= 8.1.12affected
MattermostMattermost9.8.0unaffected
MattermostMattermost9.5.4unaffected
MattermostMattermost9.7.2unaffected
MattermostMattermost9.6.2unaffected
MattermostMattermost8.1.13unaffected

Weaknesses

  • CWE-284: CWE-284: Improper Access Control

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References