CVE-2024-39839: Mattermost allows a user on a remote to set their remote username prop to an arbitrary string
4.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.29967%
CWE
Published
8/1/2024
Updated
8/7/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | >= 9.5.0, < 9.5.7 | 9.5.7 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.7.0, < 9.7.6 | 9.7.6 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.8.0, < 9.8.2 | 9.8.2 |
| github.com/mattermost/mattermost/server/v8 | go | = 9.9.0 | 9.9.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper access control during user synchronization in shared channels. Key functions would be those handling: 1) User data synchronization between clusters, and 2) Processing of remote user updates. The first vulnerable function likely fails to enforce username modification permissions during sync operations, while the second may accept unvalidated remote user properties. These functions would exist in user management and shared channel service components, consistent with Mattermost's architecture. Confidence is medium due to lack of direct code access, but aligns with CWE-284 and described attack patterns in distributed systems.