VULNERABILITY INTELLIGENCE

CVE-2024-45843

CVSS score3.1 LOW
EPSS probability0.21%
CISA KEVNot currently listed
Published2024-09-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-918
  • nvd@nist.gov: CWE-918

Primary references