CVE-2024-39839
Mattermost allows a user on a remote to set their remote username prop to an arbitrary string in github.com/mattermost/mattermost-server
4.3
MEDIUM
CVSS 3.1
EPSS 0.22%
Description
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the local server as long as the user hadn't been synced before.
How to fix CVE-2024-39839
To remediate CVE-2024-39839, upgrade the affected package to a fixed version below.
- —upgrade to 9.5.7 or later
- —upgrade to 9.5.7+incompatible or later
- —no fix listed
- —no fix listed
- —upgrade to 9.5.7 or later
- —no fix listed
Is CVE-2024-39839 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (6)
- >= 9.5.0, < 9.5.7, >= 9.7.0, < 9.7.6, >= 9.8.0, < 9.8.2 | >= 9.9.0, <= 9.9.0
- >= 9.5.0+incompatible, < 9.5.7+incompatible, >= 9.7.0+incompatible, < 9.7.6+incompatible, >= 9.8.0+incompatible, < 9.8.2+incompatible, >= 9.9.0+incompatible, < 9.9.1+incompatible
- from 0
- from 0
- >= 9.5.0, < 9.5.7
- from 0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |