CVE-2024-10214: 
Mattermost vulnerability analysis and mitigation

Mattermost versions 9.11.X <= 9.11.1 and 9.5.x <= 9.5.9 are affected by a session management vulnerability identified as CVE-2024-10214. The vulnerability was discovered and disclosed on October 28, 2024. The issue occurs when using desktop SSO, where the system incorrectly issues two sessions - one in the browser and one in desktop with incorrect settings (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 3.5 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction. The impact is primarily limited to confidentiality, with no impact on integrity or availability. The vulnerability is associated with CWE-303 (Incorrect Implementation of Authentication Algorithm) (NVD).

The vulnerability could potentially lead to information disclosure due to the incorrect session management in SSO implementation. The impact is considered low, affecting only confidentiality aspects of the system, while maintaining integrity and availability (NVD).

Users should upgrade to versions newer than 9.11.1 for the 9.11.X series or versions newer than 9.5.9 for the 9.5.x series to address this vulnerability (Mattermost Security).