{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5272", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2024-05-23T14:50:39.877Z", "datePublished": "2024-05-26T13:29:57.813Z", "dateUpdated": "2024-08-01T21:11:12.451Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "9.5.3", "status": "affected", "version": "9.5.0", "versionType": "semver"}, {"lessThanOrEqual": "9.6.1", "status": "affected", "version": "9.6.0", "versionType": "semver"}, {"lessThanOrEqual": "8.1.12", "status": "affected", "version": "8.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "9.7.0"}, {"status": "unaffected", "version": "9.5.4"}, {"status": "unaffected", "version": "9.6.2"}, {"status": "unaffected", "version": "8.1.13"}]}], "credits": [{"lang": "en", "type": "finder", "value": "BhaRat (hackit_bharat)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost versions 9.5.x &lt;= 9.5.3, 9.6.x &lt;= 9.6.1, 8.1.x &lt;= 8.1.12 fail&nbsp;to restrict the audience of the \"custom_playbooks_playbook_run_updated\" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished. </p>"}], "value": "Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail\u00a0to restrict the audience of the \"custom_playbooks_playbook_run_updated\" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-05-26T13:29:57.813Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher.</p>"}], "value": "Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher."}], "source": {"advisory": "MMSA-2024-00298", "defect": ["https://mattermost.atlassian.net/browse/MM-56462"], "discovery": "EXTERNAL"}, "title": "Run Details leak to guest via webhook event \"custom_playbooks_playbook_run_updated\"", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T14:54:17.605429Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "9.5.0", "versionType": "custom", "lessThanOrEqual": "9.5.3"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "9.6.0", "versionType": "custom", "lessThanOrEqual": "9.6.1"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "8.1.0", "versionType": "custom", "lessThanOrEqual": "8.1.12"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "unaffected", "version": "9.7.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "unaffected", "version": "9.5.4"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "unaffected", "version": "9.6.2"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "unaffected", "version": "8.1.13"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T18:02:20.278Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:11:12.451Z"}, "title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:11:12.451Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T14:54:17.605429Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "9.5.0", "versionType": "custom", "lessThanOrEqual": "9.5.3"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "9.6.0", "versionType": "custom", "lessThanOrEqual": "9.6.1"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "affected", "version": "8.1.0", "versionType": "custom", "lessThanOrEqual": "8.1.12"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "unaffected", "version": "9.7.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "unaffected", "version": "9.5.4"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "unaffected", "version": "9.6.2"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"], "vendor": "mattermost", "product": "mattermost", "versions": [{"status": "unaffected", "version": "8.1.13"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T15:03:09.939Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Run Details leak to guest via webhook event \"custom_playbooks_playbook_run_updated\"", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-56462"], "advisory": "MMSA-2024-00298", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "BhaRat (hackit_bharat)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "9.5.0", "versionType": "semver", "lessThanOrEqual": "9.5.3"}, {"status": "affected", "version": "9.6.0", "versionType": "semver", "lessThanOrEqual": "9.6.1"}, {"status": "affected", "version": "8.1.0", "versionType": "semver", "lessThanOrEqual": "8.1.12"}, {"status": "unaffected", "version": "9.7.0"}, {"status": "unaffected", "version": "9.5.4"}, {"status": "unaffected", "version": "9.6.2"}, {"status": "unaffected", "version": "8.1.13"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost to versions 9.7.0, 9.5.4, 9.6.2, 8.1.13 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail\u00a0to restrict the audience of the \"custom_playbooks_playbook_run_updated\" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished.", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost versions 9.5.x &lt;= 9.5.3, 9.6.x &lt;= 9.6.1, 8.1.x &lt;= 8.1.12 fail&nbsp;to restrict the audience of the \"custom_playbooks_playbook_run_updated\" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished. </p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-05-26T13:29:57.813Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5272", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:11:12.451Z", "dateReserved": "2024-05-23T14:50:39.877Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2024-05-26T13:29:57.813Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "47448305-8E05-4AEE-9E7B-D52AC86C7370", "versionEndExcluding": "8.1.13", "versionStartIncluding": "8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "73F3450F-7A4F-450D-BC68-E726D347636F", "versionEndExcluding": "9.5.4", "versionStartIncluding": "9.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3E36367-4F29-45EE-BCF6-CDAA8E599E85", "versionEndExcluding": "9.6.2", "versionStartIncluding": "9.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail\u00a0to restrict the audience of the \"custom_playbooks_playbook_run_updated\" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished."}, {"lang": "es", "value": "Las versiones 9.5.x &lt;= 9.5.3, 9.6.x &lt;= 9.6.1, 8.1.x &lt;= 8.1.12 de Mattermost no restringen la audiencia del evento de webhook \"custom_playbooks_playbook_run_updated\", que permite a un invitado en un canal con un Ejecuci\u00f3n del libro de jugadas vinculada para ver todos los detalles de la ejecuci\u00f3n del libro de jugadas cuando la ejecuci\u00f3n est\u00e1 marcada como finalizada."}], "id": "CVE-2024-5272", "lastModified": "2025-09-30T15:48:21.680", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}, "published": "2024-05-26T14:15:10.537", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}

{}