CVE-2024-45843

Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.

Score

CVSS 3.1 5.4 Medium

Status

Analyzed - responsibledisclosure@mattermost.com

Published

2024-09-26

Last modified

2024-09-26

Weaknesses

CWE-918

Affected products

• Mattermost (Mattermost)
• Mattermost Server (Mattermost)

References

• https://mattermost.com/security-updates