{"id":"CVE-2024-41162","published":"2024-08-01T14:05:09Z","modified":"2024-08-02T15:01:29Z","title":"Malicious remote can make an arbitrary local channel read-only","vendor":"Mattermost","product":"Mattermost","tier":"tail","description":{"text":"Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00276,"percentile":0.19936,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://mattermost.com/security-updates","tags":[]}],"priority":{"score":6.9,"factors":[{"name":"EPSS percentile","points":3.99},{"name":"CVSS severity","points":2.87}]},"vendorSlug":"mattermost","affectedVersions":[{"vendor":"Mattermost","product":"Mattermost","versions":["9.9.0",">= 9.5.0, <= 9.5.6",">= 9.7.0, <= 9.7.5",">= 9.8.0, <= 9.8.1"]}],"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","vulnerableRanges":[">=9.5.0, <9.5.7",">=9.7.0, <9.7.6",">=9.8.0, <9.8.2",">=9.9.0, <9.9.1","<8.0.0-20240628125750-70b218839fa7","all versions"],"patched":["9.5.7","9.7.6","9.8.2","9.9.1","8.0.0-20240628125750-70b218839fa7"],"from":["GHSA-jr9x-3x7m-4j75","GO-2024-3031"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost","vulnerableRanges":["<5.3.2-0.20240628125750-70b218839fa7"],"patched":["5.3.2-0.20240628125750-70b218839fa7"],"from":["GHSA-jr9x-3x7m-4j75"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":[">=9.5.0+incompatible, <9.5.7+incompatible",">=9.7.0+incompatible, <9.7.6+incompatible",">=9.8.0+incompatible, <9.8.2+incompatible",">=9.9.0+incompatible, <9.9.1+incompatible"],"patched":["9.5.7+incompatible","9.7.6+incompatible","9.8.2+incompatible","9.9.1+incompatible"],"from":["GO-2024-3031"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v5","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-3031"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v6","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-3031"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2608","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mattermost-cve-2024-39837","packageHistory":[{"cve":"CVE-2024-47003","published":"2024-09-26","fixed":"8.0.0-20240806094731-69a8b3df0f9f","kev":false,"link":{"from":"CVE-2024-41162","to":"CVE-2024-47003","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost/server/v8","fromFixed":"8.0.0-20240628125750-70b218839fa7","toFixed":"8.0.0-20240806094731-69a8b3df0f9f","daysApart":56}]}},{"cve":"CVE-2025-11776","published":"2025-11-14","fixed":"8.0.0-20250815165020-c8d66301415d","kev":false,"link":{"from":"CVE-2024-41162","to":"CVE-2025-11776","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost","fromFixed":"5.3.2-0.20240628125750-70b218839fa7","toFixed":"5.3.2-0.20250815165020-c8d66301415d","daysApart":470}]}},{"cve":"CVE-2024-39837","published":"2024-08-01","fixed":"9.9.1","kev":false,"link":{"from":"CVE-2024-39837","to":"CVE-2024-41162","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost/server/v8","fromFixed":"8.0.0-20240626164322-c758cecaf30c","toFixed":"8.0.0-20240628125750-70b218839fa7","daysApart":0},{"kind":"similar","provenance":"machine","score":0.68,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2024-39839","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-41144","published":"2024-08-01","fixed":"9.9.1","kev":false,"link":{"from":"CVE-2024-41144","to":"CVE-2024-41162","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost","fromFixed":"5.3.2-0.20240619142046-8181a9ddffc0","toFixed":"5.3.2-0.20240628125750-70b218839fa7","daysApart":0},{"kind":"similar","provenance":"machine","score":0.47,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2024-41162","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-41926","published":"2024-08-01","fixed":"9.9.1","kev":false},{"cve":"CVE-2024-32939","published":"2024-08-22","fixed":"9.10.1","kev":false},{"cve":"CVE-2024-39836","published":"2024-08-22","fixed":"9.10.1","kev":false}],"package":"Go:github.com/mattermost/mattermost/server/v8"}}