Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks

The version of Mattermost Server installed on the remote host is prior to 9.5.9, 9.10.2, or 9.11.1. It is, therefore, affected by multiple vulnerabilities.

  - Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the     frontend that are used for redirection which allows for a one-click client-side path traversal that is     leading to CSRF in Playbooks (CVE-2024-46872)

  - Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error     messages from being displayed in Playbooks which allows an attacker to generate a large response and cause     an amplified GraphQL response which in turn could cause the application to crash by sending a specially     crafted request to Playbooks. (CVE-2024-47401)

  - Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of     the message in an integration action matches with the original post metadata which allows an authenticated     user to delete an arbitrary post. (CVE-2024-50052)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2024-46872

medium

Tenable Plugins

medium