CVE-2024-1952: Mattermost incorrectly allows access individual posts

February 29, 2024

Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control the ephemeral post update to access individual posts’ contents in channels they are not a member of.

References

github.com/advisories/GHSA-r4fm-g65h-cr54
github.com/mattermost/mattermost
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2024-1952

Detect and mitigate CVE-2024-1952 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →