CVE-2024-45843

LOW

Mattermost 9.5.0-9.5.8 - Server-Side Request Forgery via Oracle Cloud and Alibaba Metadata Endpoints

Title source: llm

Description

Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.

References (1)

Core 1

Core References

Vendor Advisory

https://mattermost.com/security-updates

Scores

CVSS v3 3.1

EPSS 0.0028

EPSS Percentile 51.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (1)

mattermost/mattermost_server 9.5.0 - 9.5.9

Published Sep 26, 2024

Tracked Since Feb 18, 2026