cve.bz

CVE-2024-46872

4.6 mediumEPSS 0.2%

Medium (4.6) in mattermost mattermost server. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost/server/v8 8.0.0-20240926115259-20ed58906adc.

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks

Severity

CVSS 3.1

4.6 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-31)
CWE
CWE-352
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-762g-9p7f-mrwwGogithub.com/mattermost/mattermost/server/v8<8.0.0-20240926115259-20ed58906adc8.0.0-20240926115259-20ed58906adc
GO-2024-3233Gogithub.com/mattermost/mattermost-serverall versionsno fix published
GO-2024-3233Gogithub.com/mattermost/mattermost-server/v5all versionsno fix published
GO-2024-3233Gogithub.com/mattermost/mattermost-server/v6all versionsno fix published
GO-2024-3233Gogithub.com/mattermost/mattermost/server/v8<8.0.0-20240926115259-20ed58906adc8.0.0-20240926115259-20ed58906adc

References

Check your stackJSON