Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1jNnZwLWpqZ3YtMzh3as4AA-4J

Mattermost allows remote/synthetic users to create sessions, reset passwords

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.

Permalink: https://github.com/advisories/GHSA-c6vp-jjgv-38wj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNnZwLWpqZ3YtMzh3as4AA-4J
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 16 days ago
Updated: 15 days ago


CVSS Score: 4.8
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Identifiers: GHSA-c6vp-jjgv-38wj, CVE-2024-39836
References: Blast Radius: 0.0

Affected Packages

go:github.com/mattermost/mattermost/server/v8
Dependent packages: 2
Dependent repositories: 1
Downloads:
Affected Version Ranges: >= 9.8.0, < 9.8.3, >= 9.10.0, < 9.10.1, >= 9.5.0, < 9.5.8, >= 9.9.0, < 9.9.2
Fixed in: 9.8.3, 9.10.1, 9.5.8, 9.9.2
All affected versions:
All unaffected versions: