« Volver al listado

CVE-2024-6428

Estado: ModificadaMedia (6.5)—

Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attacker to specify both a remoteId and the user ID, resulting in creating a user with a user-defined user ID. This can cause some broken functionality in User Management such administrative actions against the user not working.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mattermost — Mattermost

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6428",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6428",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-03T13:14:16.920289Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "responsibledisclosure@mattermost.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "affectedData": [
        {
          "vendor": "Mattermost",
          "product": "Mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "9.8.0"
            },
            {
              "status": "affected",
              "version": "9.7.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.7.4"
            },
            {
              "status": "affected",
              "version": "9.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.6.2"
            },
            {
              "status": "affected",
              "version": "9.5.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.5.5"
            },
            {
              "status": "unaffected",
              "version": "9.9.0"
            },
            {
              "status": "unaffected",
              "version": "9.8.1"
            },
            {
              "status": "unaffected",
              "version": "9.7.5"
            },
            {
              "status": "unaffected",
              "version": "9.6.3"
            },
            {
              "status": "unaffected",
              "version": "9.5.6"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
          ],
          "vendor": "mattermost",
          "product": "mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "9.8.0"
            },
            {
              "status": "affected",
              "version": "9.7.0",
              "versionType": "custom",
              "lessThanOrEqual": "9.7.4"
            },
            {
              "status": "affected",
              "version": "9.6.0",
              "versionType": "custom",
              "lessThanOrEqual": "9.6.2"
            },
            {
              "status": "affected",
              "version": "9.5.0",
              "versionType": "custom",
              "lessThanOrEqual": "9.5.5"
            },
            {
              "status": "unaffected",
              "version": "9.9.0"
            },
            {
              "status": "unaffected",
              "version": "9.8.1"
            },
            {
              "status": "unaffected",
              "version": "9.7.5"
            },
            {
              "status": "unaffected",
              "version": "9.6.3"
            },
            {
              "status": "unaffected",
              "version": "9.5.6"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-03T09:15:08.013",
  "references": [
    {
      "url": "https://mattermost.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "responsibledisclosure@mattermost.com"
    },
    {
      "url": "https://mattermost.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsibledisclosure@mattermost.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attacker to specify both a remoteId and the user ID, resulting in creating a user with a user-defined user ID. This can cause some broken functionality in User Management such administrative actions against the user not working."
    },
    {
      "lang": "es",
      "value": "Las versiones de Mattermost 9.8.0, 9.7.x &lt;= 9.7.4, 9.6.x &lt;= 9.6.2, 9.5.x &lt;= 9.5.5 no evitan especificar un RemoteId al crear un nuevo usuario, lo que permite a un atacante especificar ambos. un ID remoto y el ID de usuario, lo que da como resultado la creación de un usuario con un ID de usuario definido por el usuario. Esto puede provocar que alguna funcionalidad rota en la Gestión de usuarios, como por ejemplo acciones administrativas contra el usuario, no funcionen."
    }
  ],
  "lastModified": "2026-06-17T08:17:59.793",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D07BE1B5-9663-4112-9F58-A4BAD0BEC92F",
              "versionEndExcluding": "9.5.6",
              "versionStartIncluding": "9.5.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08894FF3-4671-4A09-BC9C-9C2664072DE5",
              "versionEndExcluding": "9.6.3",
              "versionStartIncluding": "9.6.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC45455D-F190-4B91-8F5B-8E776495840D",
              "versionEndExcluding": "9.7.5",
              "versionStartIncluding": "9.7.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68C48441-A3DC-4812-9E7E-92B23E1B95BB",
              "versionEndExcluding": "9.8.1",
              "versionStartIncluding": "9.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com"
}