CVE-2024-39836 — Munged email address used for password resets and notifications

CVE-2024-39836

Munged email address used for password resets and notifications PUBLISHED

Description (CNA)

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 9.9.0 through 9.9.1; affected 9.5.0 through 9.5.7; affected 9.10.0; affected 9.8.0 through 9.8.2; unaffected 9.11.0; unaffected 9.9.2; unaffected 9.5.8; unaffected 9.10.1; unaffected 9.8.3

CWE

CWE-693

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.