CVE-2024-42411 — User creation date manipulation in POST /api/v4/users

CVE-2024-42411

User creation date manipulation in POST /api/v4/users PUBLISHED

Description (CNA)

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 9.9.0 through 9.9.1; affected 9.5.0 through 9.5.7; affected 9.10.0; affected 9.8.0 through 9.8.2; unaffected 9.11.0; unaffected 9.9.2; unaffected 9.5.8; unaffected 9.10.1; unaffected 9.8.3

CWE

CWE-754

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.