CVE-2024-1949: Infoleak
Published Feb 29, 2024
·Updated
A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.
Affected Software
4 affected componentsFixes available
go/github.com/mattermost/mattermost/server/v8<8.1.9
8.1.9
go/github.com/mattermost/mattermost/server/v8>=9.0.0<9.4.2
9.4.2
Mattermost Mattermost Server>=8.1.0<8.1.9
Mattermost Mattermost Server>=9.4.0<9.4.2
Remediation
Information
Update Mattermost Server to versions 9.5 ( 2024), 9.4.2, 8.1.9 or higher.
Event History
Feb 29, 2024
CVE Published
via MITRE·10:41 AM
Data Sourced
via MITRE·10:41 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·12:31 PM
Frequently Asked Questions
1
What versions of Mattermost are affected by CVE-2024-1949?
CVE-2024-1949 affects Mattermost versions 8.1.x before 8.1.9 and 9.4.x before 9.4.2.
2
What is the severity of CVE-2024-1949?
The severity of CVE-2024-1949 is significant as it allows authenticated attackers to gain unauthorized access to the contents of individual posts.
3
How do I fix CVE-2024-1949?
To fix CVE-2024-1949, upgrade to Mattermost version 8.1.9 or 9.4.2 or later.
4
What type of vulnerability is CVE-2024-1949?
CVE-2024-1949 is classified as a race condition vulnerability.
5
Can CVE-2024-1949 be exploited remotely?
CVE-2024-1949 requires authentication, meaning it cannot be exploited remotely by an unauthenticated attacker.