CVE-2024-36255 MEDIUM

CVE-2024-36255: Post actions can run playbook checklist task commands

Vendor Mattermost
Product Mattermost
Weakness CWE-352 · CSRF
Published May 26, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

5.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel.

Key dates

02Disclosure timeline

May 26, 2024 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-38762 WordPress Event Tickets and Registration plugin <= 5.11.0.4 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-3246 LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-54728 WordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2024-0555 Cross-Site Request Forgery (CSRF) vulnerability on WIC1200 CVE-2024-2960 SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion