CVE-2024-36257

5.3 mediumEPSS 0.3%

Medium (5.3) in mattermost mattermost. EPSS 0.3% chance of exploitation in the next 30 days.

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2024-07-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mattermost:mattermost

References

https://mattermost.com/security-updates
https://mattermost.com/security-updates

Check your stack JSON