CVE-2024-42406
- Source
- https://cve.org/CVERecord?id=CVE-2024-42406
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42406.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-42406
- Aliases
- Published
- 2024-09-26T08:04:22.939Z
- Modified
- 2026-07-15T02:12:15.695423270Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- Unauthorized access on archived channels
- Details
-
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files.
- Database specific
{ "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "9.11.0" }, { "last_affected": "9.11.0" }, { "introduced": "9.10.0" }, { "last_affected": "9.10.1" }, { "introduced": "9.9.0" }, { "last_affected": "9.9.2" }, { "introduced": "9.5.0" }, { "last_affected": "9.5.8" } ] } ], "cna_assigner": "Mattermost", "cwe_ids": [ "CWE-284" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42406.json" }- References
Affected packages
Git / github.com/mattermost/mattermost
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mattermost/mattermost
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedLast affected
- Database specific
{ "source": [ "CPE_RANGE", "CPE_STRING" ], "cpe": [ "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "cpe:2.3:a:mattermost:mattermost_server:9.11.0:-:*:*:*:*:*:*", "cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc2:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "9.5.0" }, { "fixed": "9.5.9" }, { "introduced": "9.9.0" }, { "fixed": "9.9.3" }, { "introduced": "9.10.0" }, { "fixed": "9.10.2" }, { "introduced": "9.11.0-NA" }, { "last_affected": "9.11.0-NA" }, { "introduced": "9.11.0-rc3" }, { "last_affected": "9.11.0-rc3" }, { "introduced": "9.11.0-rc1" }, { "last_affected": "9.11.0-rc1" }, { "introduced": "9.11.0-rc2" }, { "last_affected": "9.11.0-rc2" } ] }
Affected versions
9.*
9.11.0-NA
9.11.0-rc1
9.11.0-rc2
@mattermost/client@9.*
@mattermost/client@9.10.0
@mattermost/client@9.5.0
@mattermost/client@9.9.0
@mattermost/types@9.*
@mattermost/types@9.10.0
@mattermost/types@9.5.0
@mattermost/types@9.9.0
v9.*
v9.10.0
v9.10.0-rc3
v9.10.1
v9.10.1-rc1
v9.10.1-rc2
v9.10.1-rc3
v9.5.0
v9.5.0-rc3
v9.5.1
v9.5.1-rc1
v9.5.2
v9.5.3
v9.5.3-rc1
v9.5.3-rc2
v9.5.3-rc3
v9.5.4
v9.5.4-rc1
v9.5.4-rc2
v9.5.5
v9.5.5-rc1
v9.5.6
v9.5.6-rc1
v9.5.6-rc2
v9.5.7
v9.5.7-rc1
v9.5.7-rc2
v9.5.7-rc3
v9.5.8
v9.5.8-rc1
v9.5.8-rc2
v9.9.0
v9.9.0-rc4
v9.9.1
v9.9.1-rc1
v9.9.1-rc2
v9.9.1-rc3
v9.9.1-rc4
v9.9.2
v9.9.2-rc1
v9.9.2-rc2