CVE-2024-46872: Client-Side Path Traversal Leading to CSRF in Playbooks
Published Oct 29, 2024
·Updated
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks
Affected Software
4 affected componentsFixes available
go/github.com/mattermost/mattermost/server/v8<8.0.0-20240926115259-20ed58906adc
8.0.0-20240926115259-20ed58906adc
Mattermost Mattermost Server>=9.5.0<=9.5.9
Mattermost Mattermost Server>=9.10.0<=9.10.2
Mattermost Mattermost Server>=9.11.0<=9.11.1
Remediation
Information
Update Mattermost to versions 10.0.0, 9.10.3, 9.11.2, 9.5.10 or higher.
Event History
Oct 29, 2024
CVE Published
via MITRE·08:12 AM
Data Sourced
via MITRE·08:12 AM
RemedyDescriptionSeverityWeakness
Advisory Published
via GitHub·09:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-46872?
CVE-2024-46872 is considered to have a critical severity due to its potential to facilitate CSRF attacks.
2
How do I fix CVE-2024-46872?
To mitigate CVE-2024-46872, upgrade to Mattermost version 8.0.0-20240926115259-20ed58906adc or later.
3
Which versions are affected by CVE-2024-46872?
CVE-2024-46872 affects Mattermost versions 9.5.0 to 9.5.9, 9.10.0 to 9.10.2, and 9.11.0 to 9.11.1.
4
What kind of attack can be executed using CVE-2024-46872?
CVE-2024-46872 allows for a one-click client-side path traversal that could lead to CSRF attacks.
5
Is CVE-2024-46872 a server-side or client-side vulnerability?
CVE-2024-46872 is primarily a client-side vulnerability that arises from improper input sanitization.