CVSS 3.1
2.6 lowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:NCVE-2024-1949
Low (2.6) in mattermost mattermost server. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost/server/v8 8.1.9, 9.4.2.
A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-362, CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3g35-v53r-gpxc | Go | github.com/mattermost/mattermost/server/v8 | >=9.0.0 <9.4.2 | 9.4.2 |
| GHSA-3g35-v53r-gpxc | Go | github.com/mattermost/mattermost/server/v8 | <8.1.9 | 8.1.9 |
| GO-2024-2588 | Go | github.com/mattermost/mattermost-server | >=9.0.0+incompatible <9.4.2+incompatible | 9.4.2+incompatible |
| GO-2024-2588 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2024-2588 | Go | github.com/mattermost/mattermost-server/v6 | all versions | no fix published |
| GO-2024-2588 | Go | github.com/mattermost/mattermost/server/v8 | all versions | no fix published |