« Volver al listado

CVE-2024-52032

Estado: AnalizadaMedia (4.3)—

Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mattermost — Mattermost Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52032",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52032",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-12T14:51:56.470956Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "responsibledisclosure@mattermost.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "affectedData": [
        {
          "vendor": "Mattermost",
          "product": "Mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0"
            },
            {
              "status": "affected",
              "version": "9.11.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.11.2"
            },
            {
              "status": "unaffected",
              "version": "10.1.0"
            },
            {
              "status": "unaffected",
              "version": "10.0.1"
            },
            {
              "status": "unaffected",
              "version": "9.11.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-09T18:15:15.203",
  "references": [
    {
      "url": "https://mattermost.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "responsibledisclosure@mattermost.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsibledisclosure@mattermost.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled."
    },
    {
      "lang": "es",
      "value": "Las versiones 10.0.x &lt;= 10.0.0 y 9.11.x &lt;= 9.11.2 de Mattermost no pueden consultar correctamente ElasticSearch cuando buscan el nombre del canal en el conmutador de canales, lo que permite que un atacante obtenga nombres de canales privados de canales de los que no es miembro, cuando Elasticsearch v8 estaba habilitado."
    }
  ],
  "lastModified": "2026-06-17T08:06:51.020",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E0D68CA-544B-4031-AEAA-D6DD19F0424D",
              "versionEndExcluding": "9.11.3",
              "versionStartIncluding": "9.11.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D08969BB-2AE8-4583-8205-F39C44039955"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.0.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07AF48D9-3CA9-4D3F-9F2E-975858205BA3"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.0.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23737B5A-A878-46FA-9261-CF87246DF759"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.0.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF95680E-B893-42E4-A639-D9753E1C85E0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.0.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "594BC592-4333-4BC4-8868-091001AB5E36"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com"
}