CVE-2024-39837: Malicious remote can create arbitrary channels
Published Aug 1, 2024
·Updated
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.
Affected Software
9 affected componentsFixes available
go/github.com/mattermost/mattermost/server/v8=9.9.0
9.9.1
go/github.com/mattermost/mattermost/server/v8>=9.5.0<9.5.7
9.5.7
Mattermost Mattermost Server>=9.5.0<9.5.7
Mattermost Mattermost Server=9.9.0
go/github.com/mattermost/mattermost-server>=9.5.0<9.5.7
9.5.7
go/github.com/mattermost/mattermost-server/v6<6.0.0-20240626164322-c758cecaf30c
6.0.0-20240626164322-c758cecaf30c
go/github.com/mattermost/mattermost-server/v5<5.3.2-0.20240626164322-c758cecaf30c
5.3.2-0.20240626164322-c758cecaf30c
go/github.com/mattermost/mattermost-server=9.9.0
9.9.1
go/github.com/mattermost/mattermost/server/v8<8.0.0-20240626164322-c758cecaf30c
8.0.0-20240626164322-c758cecaf30c
Remediation
Information
Update Mattermost to versions 9.10.0, 9.9.1, 9.5.7 or higher.
Event History
Aug 1, 2024
CVE Published
via MITRE·02:05 PM
Data Sourced
via MITRE·02:05 PM
RemedyDescriptionSeverityWeakness
Advisory Published
via GitHub·03:32 PM
Data Sourced
via GitHub·03:32 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-39837?
CVE-2024-39837 is considered a critical vulnerability as it allows unauthorized channel creation by malicious users.
2
How do I fix CVE-2024-39837?
To fix CVE-2024-39837, upgrade Mattermost to version 9.9.1 or 9.5.7 or later.
3
What versions are affected by CVE-2024-39837?
CVE-2024-39837 affects Mattermost versions 9.9.0 and 9.5.0 to 9.5.6.
4
What is the impact of CVE-2024-39837?
The impact of CVE-2024-39837 is that it allows a malicious remote attacker to create arbitrary channels when shared channels are enabled.
5
Is there a workaround for CVE-2024-39837 before upgrading?
There is no officially recommended workaround for CVE-2024-39837, so upgrading is the best option.