CVE-2024-12247: Improper propagation of permission scheme updates across cluster nodes
Published Dec 5, 2024
·Updated
Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.
Affected Software
4 affected components
Mattermost Mattermost<=9.7.5, <=9.8.2, <=9.9.2
Mattermost Mattermost Server>=9.7.0<9.7.6
Mattermost Mattermost Server>=9.8.0<9.8.3
Mattermost Mattermost Server>=9.9.0<9.9.3
Remediation
Information
Update Mattermost to versions 10.0.0, 9.7.6, 9.8.3, 9.9.3 or higher.
Event History
Dec 5, 2024
CVE Published
via MITRE·03:20 PM
Data Sourced
via MITRE·03:20 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-12247?
CVE-2024-12247 is classified as a medium severity vulnerability.
2
How do I fix CVE-2024-12247?
To fix CVE-2024-12247, upgrade Mattermost to version 9.7.6, 9.8.3, or 9.9.3 or later.
3
What versions of Mattermost are affected by CVE-2024-12247?
Mattermost versions 9.7.x up to and including 9.7.5, 9.8.x up to and including 9.8.2, and 9.9.x up to and including 9.9.2 are affected by CVE-2024-12247.
4
What impact does CVE-2024-12247 have on user permissions?
CVE-2024-12247 allows users to retain old permissions even after the permission scheme has been updated.
5
Is CVE-2024-12247 specific to any deployment type?
CVE-2024-12247 can affect Mattermost installations that utilize clustered nodes.