CVE-2024-45843: Weak SSRF Filtering
Published Sep 26, 2024
·Updated
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.
Affected Software
1 affected component
Mattermost Mattermost Server>=9.5.0<9.5.9
Remediation
Information
Update Mattermost to versions 9.11.0, 9.5.9 or higher.
Event History
Sep 26, 2024
CVE Published
via MITRE·08:03 AM
Data Sourced
via MITRE·08:03 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-45843?
CVE-2024-45843 is classified as a medium severity vulnerability due to its potential for SSRF attacks.
2
How do I fix CVE-2024-45843?
To fix CVE-2024-45843, upgrade Mattermost to version 9.5.9 or later which addresses the SSRF issue.
3
Which versions of Mattermost are affected by CVE-2024-45843?
CVE-2024-45843 affects Mattermost versions 9.5.0 to 9.5.8 inclusive.
4
What type of vulnerability is CVE-2024-45843?
CVE-2024-45843 is a Server-Side Request Forgery (SSRF) vulnerability.
5
Can CVE-2024-45843 be exploited in public cloud environments?
Yes, CVE-2024-45843 can be exploited if Mattermost is deployed in Oracle Cloud or Alibaba without the proper denylist in place.