Open-source package vulnerability · Go

CVE-2024-39274: Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel

criticalCVSS 4.0 9.3 · 3.1 8.7GHSA-cmc8-222c-vqp9

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add users to arbitrary teams and channels

Published Aug 1, 2024 · Updated Nov 18, 2024

Affected packages

github.com/mattermost/mattermost/server/v8

Ecosystem: Go
Affected: >= 9.5.0, < 9.5.7
Fixed in: 9.5.7
Check: go list -m github.com/mattermost/mattermost/server/v8

github.com/mattermost/mattermost/server/v8

Ecosystem: Go
Affected: >= 9.7.0, < 9.7.6
Fixed in: 9.7.6
Check: go list -m github.com/mattermost/mattermost/server/v8

github.com/mattermost/mattermost/server/v8

Ecosystem: Go
Affected: >= 9.8.0, < 9.8.2
Fixed in: 9.8.2
Check: go list -m github.com/mattermost/mattermost/server/v8

github.com/mattermost/mattermost/server/v8

Ecosystem: Go
Affected: = 9.9.0
Fixed in: 9.9.1
Check: go list -m github.com/mattermost/mattermost/server/v8

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries