Mattermost allows remote actor to set arbitrary RemoteId values for synced users
Low severity
GitHub Reviewed
Published
Aug 1, 2024
to the GitHub Advisory Database
•
Updated Sep 4, 2024
Package
Affected versions
>= 9.5.0, < 9.5.7
= 9.9.0
Patched versions
9.5.7
9.9.1
Description
Published by the National Vulnerability Database
Aug 1, 2024
Published to the GitHub Advisory Database
Aug 1, 2024
Reviewed
Aug 2, 2024
Last updated
Sep 4, 2024
Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.
References