Moderate severityNVD Advisory· Published Aug 22, 2024· Updated Aug 22, 2024
Munged email address used for password resets and notifications
CVE-2024-39836
Description
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go | >= 9.9.0, < 9.9.2 | 9.9.2 |
github.com/mattermost/mattermost/server/v8Go | >= 9.5.0, < 9.5.8 | 9.5.8 |
github.com/mattermost/mattermost/server/v8Go | >= 9.10.0, < 9.10.1 | 9.10.1 |
github.com/mattermost/mattermost/server/v8Go | >= 9.8.0, < 9.8.3 | 9.8.3 |
Affected products
2- Range: 9.9.0
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-c6vp-jjgv-38wjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-39836ghsaADVISORY
- mattermost.com/security-updatesghsaWEB
News mentions
0No linked articles in our index yet.