sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-42000 Unauthorized Access to view channels' details

Low 2.7 Published Updated

Users with Read Groups permission can view details of private channels they are not members of due to missing authorization checks.

Exploited in the wild
Not known
Login needed
An administrator
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2024-42000?

CVE-2024-42000 is a low-severity missing authorization vulnerability in Mattermost Mattermost Server, published on 9 Nov 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels  which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels.

Weakness: CWE-863

Which versions are affected by CVE-2024-42000?

1 open source package ship an affected version, including mattermost. It affects 1 product.

PackageAffectedFixed in
mattermost BitnamiFrom 9.5.0 to 10.0.0-rc19.5.10, 9.10.3, 9.11.2

Products include Mattermost Mattermost Server.

How do I fix CVE-2024-42000?

Upgrade mattermost to a fixed version for your release line: 9.5.10, 9.10.3 or 9.11.2.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-42000 being exploited?

There is no known exploitation of CVE-2024-42000 in the wild and no public exploit code.

All Mattermost Mattermost Server vulnerabilities

Sources

Also known as BIT-mattermost-2024-42000, GHSA-hpq2-jq6g-6g73.

Is CVE-2024-42000 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free