CVE-2024-45835 Insufficient Electron Fuses Configuration

Q: Which versions are affected by CVE-2024-45835?

3 open source packages ship an affected version, including mattermost-desktop and mattermost. It affects 1 product.

Q: Is CVE-2024-45835 being exploited?

There is no known exploitation of CVE-2024-45835 in the wild and no public exploit code.

Q: How do I fix CVE-2024-45835?

Upgrade mattermost-desktop to 5.9.0 or later.

Low 2.5 Published 16 Sep 2024 Updated 16 Sep 2024

Attackers can bypass Electron security fuses to steal Chromium cookies or exploit misconfigurations in the Mattermost Desktop App.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2024-45835?

CVE-2024-45835 is a low-severity vulnerability in Mattermost, published on 16 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.

Weakness: CWE-693

Which versions are affected by CVE-2024-45835?

3 open source packages ship an affected version, including mattermost-desktop and mattermost. It affects 1 product.

Package	Affected	Fixed in
`mattermost-desktop` npm	All versions	`5.9.0`
`mattermost-desktop` npm	All versions	`5.9.0`
`mattermost` Bitnami	All versions	`5.9.0`

Products include Mattermost Mattermost Desktop.

How do I fix CVE-2024-45835?

Upgrade mattermost-desktop to 5.9.0 or later.

Is CVE-2024-45835 being exploited?

There is no known exploitation of CVE-2024-45835 in the wild and no public exploit code.

Sources

Also known as BIT-mattermost-2024-45835, GHSA-xgq9-7gw6-jr5r.