CVE-2024-37182

MEDIUM

Mattermost Desktop App <=5.7.0 - RCE

Title source: llm

Description

Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes.

References (1)

[Vendor Advisory] https://mattermost.com/security-updates

Scores

CVSS v3 4.7

EPSS 0.0033

EPSS Percentile 55.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-693

Status published

Affected Products (2)

mattermost/mattermost_desktop < 5.7.0

npm/mattermost-desktop < 5.8.0npm

Timeline

Published Jun 14, 2024

Tracked Since Feb 18, 2026