CVE-2024-29215: Slash commands run in channel without channel membership via playbook task commands
Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash command in a channel they are not a member of via linking a playbook run to that channel and running a slash command as a playbook task command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 9.8.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 9.5.4 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 9.7.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 9.6.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 8.1.13
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29215?
CVE-2024-29215 is classified as a medium severity vulnerability due to improper access control within Mattermost.
How do I fix CVE-2024-29215?
To mitigate CVE-2024-29215, users should update Mattermost to versions beyond 9.5.3, 9.7.1, 9.6.1, or 8.1.12, where the vulnerability is addressed.
What versions of Mattermost are affected by CVE-2024-29215?
CVE-2024-29215 affects Mattermost versions 9.5.x up to 9.5.3, 9.7.x up to 9.7.1, 9.6.x up to 9.6.1, and 8.1.x up to 8.1.12.
What type of vulnerability is CVE-2024-29215?
CVE-2024-29215 is an access control vulnerability that allows unauthorized command execution in Mattermost channels.
Can CVE-2024-29215 impact my organization's data?
Yes, CVE-2024-29215 can potentially allow unauthorized users to run slash commands in channels they are not members of, impacting the integrity of your organization's data.