CVE-2024-29221

Description

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.

How to fix CVE-2024-29221

To remediate CVE-2024-29221, upgrade the affected package to a fixed version below.

• —upgrade to 8.1.11 or later
• —upgrade to 9.3.3+incompatible or later
• —no fix listed
• —no fix listed
• —upgrade to 8.1.11 or later
• —no fix listed

Is CVE-2024-29221 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• >= 8.1.0, < 8.1.11, >= 9.3.0, < 9.3.3, >= 9.4.0, < 9.4.4, >= 9.5.0, < 9.5.2
• >= 9.3.0+incompatible, < 9.3.3+incompatible, >= 9.4.0+incompatible, < 9.4.4+incompatible, >= 9.5.0+incompatible, < 9.5.2+incompatible
• from 0
• from 0
• >= 8.1.0, < 8.1.11
• from 0

CVSS scores

References (9)

• ADVISORYgithub.com/advisories/GHSA-w67v-ph4x-f48q
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-29221
• PATCHgithub.com/mattermost/mattermost
• WEBgithub.com/mattermost/mattermost/commit/0dc03fbc6e3c9afb14137e72ab3fa6f5a0125b9c