{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-02T02:42:21.396","vulnerabilities":[{"cve":{"id":"CVE-2024-39361","sourceIdentifier":"responsibledisclosure@mattermost.com","published":"2024-07-03T09:15:06.917","lastModified":"2024-11-21T09:27:32.293","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an attacker to specify both a remoteId and the post ID, resulting in creating a post with a user-defined post ID. This can cause some broken functionality in the channel or thread with user-defined posts"},{"lang":"es","value":"Las versiones de Mattermost 9.8.0, 9.7.x &lt;= 9.7.4, 9.6.x &lt;= 9.6.2 y 9.5.x &lt;= 9.5.5 no evitan que los usuarios especifiquen un RemoteId para sus publicaciones, lo que permite a un atacante especificar ambos. un ID remoto y el ID de la publicación, lo que da como resultado la creación de una publicación con una ID de publicación definida por el usuario. Esto puede causar alguna funcionalidad rota en el canal o hilo con publicaciones definidas por el usuario."}],"metrics":{"cvssMetricV31":[{"source":"responsibledisclosure@mattermost.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}]},"weaknesses":[{"source":"responsibledisclosure@mattermost.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.6","matchCriteriaId":"D07BE1B5-9663-4112-9F58-A4BAD0BEC92F"},{"vulnerable":true,"criteria":"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*","versionStartIncluding":"9.6.0","versionEndExcluding":"9.6.3","matchCriteriaId":"08894FF3-4671-4A09-BC9C-9C2664072DE5"},{"vulnerable":true,"criteria":"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*","versionStartIncluding":"9.7.0","versionEndExcluding":"9.7.4","matchCriteriaId":"93806FF3-A98A-442B-AC2C-D5BB18D3D54F"},{"vulnerable":true,"criteria":"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*","versionStartIncluding":"9.8.0","versionEndExcluding":"9.8.1","matchCriteriaId":"68C48441-A3DC-4812-9E7E-92B23E1B95BB"}]}]}],"references":[{"url":"https://mattermost.com/security-updates","source":"responsibledisclosure@mattermost.com","tags":["Vendor Advisory"]},{"url":"https://mattermost.com/security-updates","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}