CVE-2024-42411: User creation date manipulation in POST /api/v4/users
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42411?
CVE-2024-42411 is classified as a medium severity vulnerability due to its potential to mislead administrators regarding user account age.
How do I fix CVE-2024-42411?
To fix CVE-2024-42411, upgrade Mattermost to version 9.9.2 or later, 9.10.1 or later, 9.5.8 or later, or 9.8.3 or later.
What impact does CVE-2024-42411 have on Mattermost users?
CVE-2024-42411 allows users to manipulate the creation date of their accounts, potentially deceiving administrators.
Which versions of Mattermost are affected by CVE-2024-42411?
Mattermost versions 9.9.x up to 9.9.1, 9.5.x up to 9.5.7, 9.10.x up to 9.10.0, and 9.8.x up to 9.8.2 are affected by CVE-2024-42411.
Who should be concerned about CVE-2024-42411?
Administrators and users of Mattermost versions affected by CVE-2024-42411 should ensure they upgrade to secure versions.