low2.7
CVE-2024-4195
Mattermost allows team admins to promote guests to team admins
Impact
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-server | >= 9.5.0, <= 9.5.2 | 9.5.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | from 8.1.0 before 8.1.12 from 9.5.0 before 9.5.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://mattermost.com/security-updates
- https://github.com/advisories/GHSA-5fh7-7mw7-mmx5
- https://nvd.nist.gov/vuln/detail/CVE-2024-4195
- https://github.com/mattermost/mattermost/commit/1e3497e0595bb4f9908c94dd9d4685d48556b7e8
- https://github.com/mattermost/mattermost/commit/f0872dd4e4ba34f061aa6982a71c7c29532aac2e