CVE-2024-5272 MEDIUM

CVE-2024-5272: Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"

Vendor Mattermost
Product Mattermost
Weakness CWE-284
Published May 26, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished.

Key dates

02Disclosure timeline

May 26, 2024 CVE published
August 1, 2024 Record updated