CVE-2024-50052 MEDIUM

CVE-2024-50052: Arbitrary post deletion via Playbooks /ignore-thread endpoint

Vendor Mattermost
Product Mattermost
Weakness CWE-862 · Missing authorization
Published October 29, 2024
Last update October 29, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.

Key dates

02Disclosure timeline

October 29, 2024 CVE published
October 29, 2024 Record updated