What is GHSA-2jhx-w3vc-w59g?

GHSA-2jhx-w3vc-w59g is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost allows guest user with read access to upload files to a channel

Which CVE IDs does GHSA-2jhx-w3vc-w59g cover?

GHSA-2jhx-w3vc-w59g covers the following CVE IDs: CVE-2024-43780. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2jhx-w3vc-w59g?

GHSA-2jhx-w3vc-w59g has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-2jhx-w3vc-w59g?

GHSA-2jhx-w3vc-w59g affects 4 products, including: go/github.com/mattermost/mattermost/server/v8:\u003e= 9.5.0, \u003c 9.5.8; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.10.0, \u003c 9.10.1; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.9.0, \u003c 9.9.2; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.8.0, \u003c 9.8.3.

GHSA-2jhx-w3vc-w59gMediumCVSS 4.3

Mattermost allows guest user with read access to upload files to a channel

Vendor

GitHub Security Advisories

Published

August 22, 2024

Last Modified

August 22, 2024

🔗 CVE IDs covered (1)

CVE-2024-43780 →

📋 Description

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel.

🎯 Affected products4

go/github.com/mattermost/mattermost/server/v8:>= 9.5.0, < 9.5.8
go/github.com/mattermost/mattermost/server/v8:>= 9.10.0, < 9.10.1
go/github.com/mattermost/mattermost/server/v8:>= 9.9.0, < 9.9.2
go/github.com/mattermost/mattermost/server/v8:>= 9.8.0, < 9.8.3

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-43780
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-2jhx-w3vc-w59g