CVE-2024-39836 Munged email address used for password resets and notifications
Attackers can hijack accounts by exploiting munged email addresses in shared channels to reset passwords and receive notifications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39836?
CVE-2024-39836 is a medium-severity authentication bypass vulnerability in Mattermost Mattermost, published on 22 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.
Weakness: CWE-693
Which versions are affected by CVE-2024-39836?
12 open source packages ship an affected version, including github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server and github.com/mattermost/mattermost-server/v5. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/mattermost/mattermost/server/v8 Go | All versions | None |
github.com/mattermost/mattermost/server/v8 Go | From 9.10.0 | 9.10.1 |
github.com/mattermost/mattermost/server/v8 Go | From 9.10.0 | 9.10.1 |
github.com/mattermost/mattermost/server/v8 Go | From 9.5.0 | 9.5.8 |
github.com/mattermost/mattermost/server/v8 Go | From 9.5.0 | 9.5.8 |
github.com/mattermost/mattermost/server/v8 Go | From 9.8.0 | 9.8.3 |
6 more packages
github.com/mattermost/mattermost/server/v8 Go | From 9.8.0 | 9.8.3 |
github.com/mattermost/mattermost/server/v8 Go | From 9.9.0 | 9.9.2 |
github.com/mattermost/mattermost/server/v8 Go | From 9.9.0 | 9.9.2 |
github.com/mattermost/mattermost-server Go | From 9.5.0+incompatible | 9.5.8+incompatible, 9.8.3+incompatible, 9.9.2+incompatible, 9.10.1+incompatible |
github.com/mattermost/mattermost-server/v5 Go | All versions | None |
github.com/mattermost/mattermost-server/v6 Go | All versions | None |
Products include Mattermost Mattermost.
How do I fix CVE-2024-39836?
Upgrade github.com/mattermost/mattermost/server/v8 to a fixed version for your release line: 9.10.1, 9.5.8, 9.8.3 or 9.9.2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-39836 being exploited?
There is no known exploitation of CVE-2024-39836 in the wild and no public exploit code.
Other vulnerabilities in Mattermost Mattermost
- CVE-2019-20851 Path traversal in n/a
- CVE-2024-39274 Malicious remote can add users to arbitrary teams and channels
- CVE-2024-39777 Malicious remote can invite itself to an arbitrary local channel
- CVE-2024-39830 Timing attack during remote cluster token comparison when shared channels are enabled
- CVE-2023-3615 Lack of server certificate validation in websockets connection
Sources
Also known as GHSA-c6vp-jjgv-38wj, GO-2024-3096.