Vulnerability · Published Apr 5, 2024 · Assigned by Mattermost
CVE-2024-21848Users maintain access to active call after being removed from a channel
Low 3.1
In plain English
A low-severity improper access control in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.3%top 75.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | no fix listed | GO-2024-2707 |
| Go | github.com/mattermost/mattermost-server/v5 | no fix listed | GO-2024-2707 |
| Go | github.com/mattermost/mattermost-server/v6 | no fix listed | GO-2024-2707 |
| Go | github.com/mattermost/mattermost/server/v8 | 8.1.11 | GHSA-xp9j-8p68-9q93 |
| Go | github.com/mattermost/mattermost/server/v8 | no fix listed | GO-2024-2707 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 8.1.0 – through 8.1.10 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N