{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-12247", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2024-12-05T15:06:26.110Z", "datePublished": "2024-12-05T15:20:49.383Z", "dateUpdated": "2024-12-05T16:58:59.768Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "9.7.5", "status": "affected", "version": "9.7.0", "versionType": "semver"}, {"lessThanOrEqual": "9.8.2", "status": "affected", "version": "9.8.0", "versionType": "semver"}, {"lessThanOrEqual": "9.9.2", "status": "affected", "version": "9.9.0", "versionType": "semver"}, {"status": "unaffected", "version": "10.0.0"}, {"status": "unaffected", "version": "9.7.6"}, {"status": "unaffected", "version": "9.8.3"}, {"status": "unaffected", "version": "9.9.3"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Leandro Chaves (brdoors3)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost versions 9.7.x &lt;= 9.7.5, 9.8.x &lt;= 9.8.2 and 9.9.x &lt;= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.</p>"}], "value": "Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-12-05T15:20:49.383Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost to versions 10.0.0, 9.7.6, 9.8.3, 9.9.3 or higher.</p>"}], "value": "Update Mattermost to versions 10.0.0, 9.7.6, 9.8.3, 9.9.3 or higher."}], "source": {"advisory": "MMSA-2023-00259", "defect": ["https://mattermost.atlassian.net/browse/MM-54740"], "discovery": "EXTERNAL"}, "title": "Improper propagation of permission scheme updates across cluster nodes", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-05T16:58:43.853029Z", "id": "CVE-2024-12247", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-05T16:58:59.768Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-12247", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-05T16:58:43.853029Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-05T16:58:49.999Z"}}], "cna": {"title": "Improper propagation of permission scheme updates across cluster nodes", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-54740"], "advisory": "MMSA-2023-00259", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Leandro Chaves (brdoors3)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "9.7.0", "versionType": "semver", "lessThanOrEqual": "9.7.5"}, {"status": "affected", "version": "9.8.0", "versionType": "semver", "lessThanOrEqual": "9.8.2"}, {"status": "affected", "version": "9.9.0", "versionType": "semver", "lessThanOrEqual": "9.9.2"}, {"status": "unaffected", "version": "10.0.0"}, {"status": "unaffected", "version": "9.7.6"}, {"status": "unaffected", "version": "9.8.3"}, {"status": "unaffected", "version": "9.9.3"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 10.0.0, 9.7.6, 9.8.3, 9.9.3 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost to versions 10.0.0, 9.7.6, 9.8.3, 9.9.3 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost versions 9.7.x &lt;= 9.7.5, 9.8.x &lt;= 9.8.2 and 9.9.x &lt;= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2024-12-05T15:20:49.383Z"}}}, "cveMetadata": {"cveId": "CVE-2024-12247", "state": "PUBLISHED", "dateUpdated": "2024-12-05T16:58:59.768Z", "dateReserved": "2024-12-05T15:06:26.110Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2024-12-05T15:20:49.383Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5C9F963-57DF-41E2-AA46-242317D93786", "versionEndExcluding": "9.7.6", "versionStartIncluding": "9.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "A37536AB-52C7-4670-AA72-86CD7819CD22", "versionEndExcluding": "9.8.3", "versionStartIncluding": "9.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "20276949-478F-4F2C-9D07-F9B3C04CADD9", "versionEndExcluding": "9.9.3", "versionStartIncluding": "9.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated."}, {"lang": "es", "value": "Las versiones 9.7.x &lt;= 9.7.5, 9.8.x &lt;= 9.8.2 y 9.9.x &lt;= 9.9.2 de Mattermost no logran propagar correctamente las actualizaciones del esquema de permisos entre los nodos del cl\u00faster, lo que permite que un usuario conserve los permisos antiguos, incluso si se ha actualizado el esquema de permisos."}], "id": "CVE-2024-12247", "lastModified": "2025-10-01T18:21:08.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-12-05T16:15:25.243", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T22:01:18.556603+00:00", "updated": "2025-07-12T22:01:18.556658+00:00", "vendors": ["mattermost", "mattermost$PRODUCT$mattermost"]}