CVE-2024-39613 — RCE in desktop app in Windows by local attacker

CVE-2024-39613

RCE in desktop app in Windows by local attacker PUBLISHED

Description (CNA)

Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 5.8.0; unaffected 5.9.0

CWE

CWE-427

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.