CVE-2024-29977: 
Mattermost vulnerability analysis and mitigation

Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 contain a vulnerability related to improper validation of synced reactions when shared channels are enabled. This vulnerability was assigned CVE-2024-29977 and was disclosed on August 1, 2024 (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The CNA (Mattermost, Inc.) assigned a lower CVSS score of 2.7 (LOW) with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-284 (Improper Access Control) (NVD).

When exploited, this vulnerability allows a malicious remote actor to create arbitrary reactions on arbitrary posts within the Mattermost platform when shared channels are enabled (NVD).

The vulnerability requires network access and authenticated user access to exploit. The attack complexity is considered low, but privileged access is required according to the vendor's CVSS assessment (NVD).

Users should upgrade to versions newer than 9.5.6 for the 9.5.x series or versions newer than 9.9.0 for the 9.9.x series to address this vulnerability (NVD).