CVE-2024-36492

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in shared channels. which allows a malicious remote to overwrite an existing local user.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Aug 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-364937.2A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic() functionality of Wavlink AC3000 M33A8.V5030.210505. CVE-2024-364944.7Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other CVE-2024-364957.7The application Faronics WINSelect (Standard + Enterprise) saves its configuration in an encrypted file on the file system which "Everyone" CVE-2024-364967.5The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt thi CVE-2024-364979.1The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be used to remove the exi CVE-2024-364984.7Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other CVE-2024-364995.5Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect servic CVE-2024-36505.4The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all ver CVE-2024-365005.5Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect service confidentialit CVE-2024-365015.5Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity.CVE-2024-365025.5Out-of-bounds read vulnerability in the audio module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-365035.5Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.