Skip to main content

Improper Check for Unusual or Exceptional Conditions

CVE-2024-42411

Medium
5.3/10

Summary

Mattermost versions 9.5.x prior to 9.5.8-rc2, 9.8.x prior to 9.8.3-rc2, 9.9.x prior to 9.9.2-rc2, and 9.10.x prior to 9.10.1-rc2 failed to restrict the input in POST "/api/v4/users" which allows a user to manipulate the creation date in POST "/api/v4/users" tricking the admin into believing their account is much older.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.

References

Advisory Timeline

  • Published