VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 3, 2024· Updated Aug 2, 2024

Timing attack during remote cluster token comparison when shared channels are enabled

CVE-2024-39830

Description

Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison for remote cluster tokens which allows an attacker to retrieve the remote cluster token via a timing attack during remote cluster token comparison.

Affected products

1

Patches

4
01723a784c5e
https://github.com/mattermost/mattermost-servervia osv
327e1a1dad17
https://github.com/mattermost/mattermost-servervia osv
b5bf2d4ab223
https://github.com/mattermost/mattermost-servervia osv
6eb3d42f52be
https://github.com/mattermost/mattermost-servervia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.