CVE-2024-42497

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-424995.3Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this CVE-2024-42508.8A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been declared as critical. Affected by this vulnerability is the function form CVE-2024-425009.3HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.CVE-2024-425017.2An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to i CVE-2024-425027.2Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability re CVE-2024-425037.2Authenticated command execution vulnerability exist in the ArubaOS command line interface (CLI). Successful exploitation of this vulnerabil CVE-2024-425044.3A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the login CVE-2024-425059.8Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially cra CVE-2024-425069.8Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially cra CVE-2024-425079.8Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially cra CVE-2024-425085.5This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users.CVE-2024-425099.8Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially craft