CVE-2024-36255

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 9.5.0, <= 9.5.3; >= 9.6.0, <= 9.6.1; >= 8.1.0, <= 8.1.12
mattermost	mattermost	>= 9.5.x, <= 9.5.3
mattermost	mattermost	>= 9.6.x, <= 9.6.1
mattermost	mattermost	>= 8.1.x, <= 8.1.12

References

https://mattermost.com/security-updatesVendor Advisory
https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: May 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-362575.3Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remo CVE-2024-362589.8A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210 CVE-2024-362596.5Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sens CVE-2024-36264.3The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln CVE-2024-362609.8in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.CVE-2024-362615.7Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of s CVE-2024-362627.2Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enab CVE-2024-362638.1** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache CVE-2024-362649.8** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set CVE-2024-362659.8** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine CVE-2024-362667.8A vulnerability has been identified in PowerSys (All versions < V3.11). The affected application insufficiently protects responses to authen CVE-2024-362678.1Path traversal vulnerability exists in Redmine DMSF Plugin versions prior to 3.1.4. If this vulnerability is exploited, a logged-in user may