What is CVE-2024-1942?

CVE-2024-1942 is a vulnerability with a medium severity level that affects certain versions of Mattermost, a popular communication platform. This vulnerability allows authenticated attackers to access the contents of individual posts in channels they are not a member of, due to a failure in sanitizing metadata on posts containing permalinks under specific conditions.

Who is impacted by CVE-2024-1942?

Specifically, it impacts those using Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0. Due to a failure in sanitizing metadata on posts containing permalinks under certain conditions, attackers can access the contents of individual posts in channels they are not a member of, posing a risk to secure communication.

What should I do if I’m affected?

If you're affected by the CVE-2024-1942 vulnerability, it's important to take action to secure your Mattermost communication platform. Follow these simple steps:

1. Update to the latest version of Mattermost software

2. Monitor the Security Updates page for new information

3. Join the Security Bulletin for fix release notifications

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-1942 vulnerability is currently awaiting analysis in CISA's Known Exploited Vulnerabilities Catalog.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-284, which involves improper access control in certain versions of Mattermost.

Learn More

For comprehensive information on this vulnerability, consult the NVD page or the sources listed below.

• Mattermost Security Updates

• CWE-284