CVE-2024-42000: Unauthorized Access to view channels' details
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42000?
The severity of CVE-2024-42000 is high due to improper authorization allowing unauthorized access to private channel details.
How do I fix CVE-2024-42000?
To fix CVE-2024-42000, update Mattermost servers to versions 9.10.3, 9.11.2, or 10.0.1 or later.
Which versions of Mattermost are affected by CVE-2024-42000?
CVE-2024-42000 affects Mattermost versions 9.10.x up to 9.10.2, 9.11.x up to 9.11.1, 9.5.x up to 9.5.9, and 10.0.0.
What type of authentication issue does CVE-2024-42000 represent?
CVE-2024-42000 is an authentication issue that allows users with limited permissions to access information they should not be able to see.
Can only system managers exploit CVE-2024-42000?
No, any user with 'Read Groups' permission can exploit CVE-2024-42000, regardless of their access to channels.