From 7ab0f35bb3deafe1ed1486d8d64d591cf9932d97 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 23 Aug 2024 21:18:31 +0000 Subject: [PATCH] Publish Advisories GHSA-4ww8-fprq-cq34 GHSA-5263-pm2h-m7hw GHSA-869f-px86-vj84 GHSA-c6vp-jjgv-38wj GHSA-hrf9-rm95-fpf3 GHSA-4ww8-fprq-cq34 GHSA-5263-pm2h-m7hw GHSA-c6vp-jjgv-38wj GHSA-hrf9-rm95-fpf3 --- .../GHSA-4ww8-fprq-cq34.json | 123 ++++++++++++++++++ .../GHSA-5263-pm2h-m7hw.json | 122 +++++++++++++++++ .../GHSA-869f-px86-vj84.json | 35 ++++- .../GHSA-c6vp-jjgv-38wj.json | 122 +++++++++++++++++ .../GHSA-hrf9-rm95-fpf3.json | 122 +++++++++++++++++ .../GHSA-4ww8-fprq-cq34.json | 39 ------ .../GHSA-5263-pm2h-m7hw.json | 38 ------ .../GHSA-c6vp-jjgv-38wj.json | 38 ------ .../GHSA-hrf9-rm95-fpf3.json | 38 ------ 9 files changed, 520 insertions(+), 157 deletions(-) create mode 100644 advisories/github-reviewed/2024/08/GHSA-4ww8-fprq-cq34/GHSA-4ww8-fprq-cq34.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-5263-pm2h-m7hw/GHSA-5263-pm2h-m7hw.json rename advisories/{unreviewed => github-reviewed}/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json (50%) create mode 100644 advisories/github-reviewed/2024/08/GHSA-c6vp-jjgv-38wj/GHSA-c6vp-jjgv-38wj.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-hrf9-rm95-fpf3/GHSA-hrf9-rm95-fpf3.json delete mode 100644 advisories/unreviewed/2024/08/GHSA-4ww8-fprq-cq34/GHSA-4ww8-fprq-cq34.json delete mode 100644 advisories/unreviewed/2024/08/GHSA-5263-pm2h-m7hw/GHSA-5263-pm2h-m7hw.json delete mode 100644 advisories/unreviewed/2024/08/GHSA-c6vp-jjgv-38wj/GHSA-c6vp-jjgv-38wj.json delete mode 100644 advisories/unreviewed/2024/08/GHSA-hrf9-rm95-fpf3/GHSA-hrf9-rm95-fpf3.json diff --git a/advisories/github-reviewed/2024/08/GHSA-4ww8-fprq-cq34/GHSA-4ww8-fprq-cq34.json b/advisories/github-reviewed/2024/08/GHSA-4ww8-fprq-cq34/GHSA-4ww8-fprq-cq34.json new file mode 100644 index 00000000000..2f113d1d45f --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-4ww8-fprq-cq34/GHSA-4ww8-fprq-cq34.json @@ -0,0 +1,123 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4ww8-fprq-cq34", + "modified": "2024-08-23T21:17:12Z", + "published": "2024-08-22T09:30:32Z", + "aliases": [ + "CVE-2024-32939" + ], + "summary": "Mattermost doesn't redact remote users' original email addresses", + "details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.9.0" + }, + { + "fixed": "9.9.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.5.0" + }, + { + "fixed": "9.5.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.10.0" + }, + { + "fixed": "9.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.8.0" + }, + { + "fixed": "9.8.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32939" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284", + "CWE-312" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-23T21:17:12Z", + "nvd_published_at": "2024-08-22T07:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-5263-pm2h-m7hw/GHSA-5263-pm2h-m7hw.json b/advisories/github-reviewed/2024/08/GHSA-5263-pm2h-m7hw/GHSA-5263-pm2h-m7hw.json new file mode 100644 index 00000000000..c64f42c6e1d --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-5263-pm2h-m7hw/GHSA-5263-pm2h-m7hw.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5263-pm2h-m7hw", + "modified": "2024-08-23T21:17:18Z", + "published": "2024-08-22T09:30:32Z", + "aliases": [ + "CVE-2024-8071" + ], + "summary": "Mattermost doesn't restrict which roles can promote a user as system admin", + "details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.9.0" + }, + { + "fixed": "9.9.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.5.0" + }, + { + "fixed": "9.5.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.10.0" + }, + { + "fixed": "9.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.8.0" + }, + { + "fixed": "9.8.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8071" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-23T21:17:18Z", + "nvd_published_at": "2024-08-22T07:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json b/advisories/github-reviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json similarity index 50% rename from advisories/unreviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json rename to advisories/github-reviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json index 9a88b436af4..8d83d9d7d19 100644 --- a/advisories/unreviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json +++ b/advisories/github-reviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-869f-px86-vj84", - "modified": "2024-08-23T09:30:35Z", + "modified": "2024-08-23T21:17:09Z", "published": "2024-08-23T09:30:35Z", "aliases": [ "CVE-2024-43105" ], + "summary": "Mattermost Plugin Channel Export excessive resource consumption", "details": "Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by running the /export command multiple times at once.", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-plugin-channel-export" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43105" }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost-plugin-channel-export/commit/bb6da1f6bedd6cefe2276d6493b5541843c543a6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost-plugin-channel-export" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -31,8 +58,8 @@ "CWE-400" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-08-23T21:17:09Z", "nvd_published_at": "2024-08-23T08:15:04Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-c6vp-jjgv-38wj/GHSA-c6vp-jjgv-38wj.json b/advisories/github-reviewed/2024/08/GHSA-c6vp-jjgv-38wj/GHSA-c6vp-jjgv-38wj.json new file mode 100644 index 00000000000..39e61a393e4 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-c6vp-jjgv-38wj/GHSA-c6vp-jjgv-38wj.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c6vp-jjgv-38wj", + "modified": "2024-08-23T21:17:15Z", + "published": "2024-08-22T09:30:32Z", + "aliases": [ + "CVE-2024-39836" + ], + "summary": "Mattermost allows remote/synthetic users to create sessions, reset passwords", + "details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.9.0" + }, + { + "fixed": "9.9.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.5.0" + }, + { + "fixed": "9.5.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.10.0" + }, + { + "fixed": "9.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.8.0" + }, + { + "fixed": "9.8.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39836" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-693" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-23T21:17:15Z", + "nvd_published_at": "2024-08-22T07:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-hrf9-rm95-fpf3/GHSA-hrf9-rm95-fpf3.json b/advisories/github-reviewed/2024/08/GHSA-hrf9-rm95-fpf3/GHSA-hrf9-rm95-fpf3.json new file mode 100644 index 00000000000..59c3a12637c --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-hrf9-rm95-fpf3/GHSA-hrf9-rm95-fpf3.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hrf9-rm95-fpf3", + "modified": "2024-08-23T21:17:16Z", + "published": "2024-08-22T09:30:32Z", + "aliases": [ + "CVE-2024-40886" + ], + "summary": "Mattermost Cross-Site Request Forgery vulnerability", + "details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.9.0" + }, + { + "fixed": "9.9.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.5.0" + }, + { + "fixed": "9.5.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.10.0" + }, + { + "fixed": "9.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.8.0" + }, + { + "fixed": "9.8.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40886" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-23T21:17:16Z", + "nvd_published_at": "2024-08-22T07:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-4ww8-fprq-cq34/GHSA-4ww8-fprq-cq34.json b/advisories/unreviewed/2024/08/GHSA-4ww8-fprq-cq34/GHSA-4ww8-fprq-cq34.json deleted file mode 100644 index 3323a5b171b..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-4ww8-fprq-cq34/GHSA-4ww8-fprq-cq34.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4ww8-fprq-cq34", - "modified": "2024-08-22T09:30:32Z", - "published": "2024-08-22T09:30:32Z", - "aliases": [ - "CVE-2024-32939" - ], - "details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server.\"", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32939" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284", - "CWE-312" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-22T07:15:03Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-5263-pm2h-m7hw/GHSA-5263-pm2h-m7hw.json b/advisories/unreviewed/2024/08/GHSA-5263-pm2h-m7hw/GHSA-5263-pm2h-m7hw.json deleted file mode 100644 index 26c67e7d528..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-5263-pm2h-m7hw/GHSA-5263-pm2h-m7hw.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5263-pm2h-m7hw", - "modified": "2024-08-22T09:30:32Z", - "published": "2024-08-22T09:30:32Z", - "aliases": [ - "CVE-2024-8071" - ], - "details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8071" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-22T07:15:04Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-c6vp-jjgv-38wj/GHSA-c6vp-jjgv-38wj.json b/advisories/unreviewed/2024/08/GHSA-c6vp-jjgv-38wj/GHSA-c6vp-jjgv-38wj.json deleted file mode 100644 index 574d3a08d18..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-c6vp-jjgv-38wj/GHSA-c6vp-jjgv-38wj.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-c6vp-jjgv-38wj", - "modified": "2024-08-23T18:33:00Z", - "published": "2024-08-22T09:30:32Z", - "aliases": [ - "CVE-2024-39836" - ], - "details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39836" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-693" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-22T07:15:03Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-hrf9-rm95-fpf3/GHSA-hrf9-rm95-fpf3.json b/advisories/unreviewed/2024/08/GHSA-hrf9-rm95-fpf3/GHSA-hrf9-rm95-fpf3.json deleted file mode 100644 index 4bdc1845031..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-hrf9-rm95-fpf3/GHSA-hrf9-rm95-fpf3.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hrf9-rm95-fpf3", - "modified": "2024-08-23T18:33:00Z", - "published": "2024-08-22T09:30:32Z", - "aliases": [ - "CVE-2024-40886" - ], - "details": "Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40886" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-22T07:15:04Z" - } -} \ No newline at end of file