← CVE Intelligence

CVE-2024-39767

Spoofed push notifications from malicious server PUBLISHED

Description (CNA)

Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and have them show up in mobile apps as that server’s push notifications.

Affected (CNA)

Vendor / productVersions
Mattermost / Mattermostaffected 0 through 2.16.0; unaffected 2.17.0

CWE

CWE-287

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.