CVE-2024-43780

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-437815.5A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in conne CVE-2024-437829.8This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving CVE-2024-437837.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2024-437845.7lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials t CVE-2024-437852.5gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the CVE-2024-437875.0Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Con CVE-2024-437886.1Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, CVE-2024-437894.3Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them al CVE-2024-43795.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in CVE-2024-437905.5Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), CVE-2024-437917.8RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning CVE-2024-437926.1Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project.