CVE-2024-2447

Description

Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.

How to fix CVE-2024-2447

To remediate CVE-2024-2447, upgrade the affected package to a fixed version below.

• —upgrade to 8.1.11 or later
• —upgrade to 9.3.3+incompatible or later
• —no fix listed
• —no fix listed
• —upgrade to 8.1.11 or later
• —no fix listed

Is CVE-2024-2447 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• >= 8.1.0, < 8.1.11, >= 9.3.0, < 9.3.3, >= 9.4.0, < 9.4.4, >= 9.5.0, < 9.5.2
• >= 9.3.0+incompatible, < 9.3.3+incompatible, >= 9.4.0+incompatible, < 9.4.4+incompatible, >= 9.5.0+incompatible, < 9.5.2+incompatible
• from 0
• from 0
• >= 8.1.0, < 8.1.11
• from 0

CVSS scores

References (4)

• ADVISORYgithub.com/advisories/GHSA-wp43-vprh-c3w5
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-2447
• PATCHmattermost/mattermost
• WEBmattermost.com/security-updates