Old Permissions Can be Kept Even After Updating Permission Scheme
CVE-2024-12247

4.6MEDIUM

Key Information:

Vendor
Mattermost
Status
Mattermost
Vendor
CVE Published:
5 December 2024

Summary

Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.

Affected Version(s)

Mattermost 9.7.0 <= 9.7.5

Mattermost 9.8.0 <= 9.8.2

Mattermost 9.9.0 <= 9.9.2

References

https://mattermost.com/security-updates

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Leandro Chaves (brdoors3)
.