CVE-2024-45835: 
JavaScript vulnerability analysis and mitigation

Mattermost Desktop App versions <=5.8.0 contains a security vulnerability related to insufficient configuration of Electron Fuses. The vulnerability was discovered and disclosed on September 16, 2024. This issue affects all Mattermost Desktop App versions up to and including version 5.8.0 (NVD).

The vulnerability stems from insufficient configuration of Electron Fuses in the Mattermost Desktop App. This misconfiguration allows potential attackers to gather Chromium cookies or exploit other misconfigurations through remote or local access. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, while Mattermost Inc. assessed it with a lower score of 2.5 (LOW) with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows attackers to potentially access Chromium cookies and exploit other misconfigurations in the application. This could lead to unauthorized access to user data and potential security breaches through the exposed Chromium cookies (NVD).

The vulnerability can be exploited through both remote and local access vectors. The differing CVSS scores from NIST and Mattermost Inc. suggest varying assessments of the exploitation difficulty, with NIST indicating a more accessible attack vector compared to Mattermost's assessment of requiring local access with high attack complexity (NVD).

Users should upgrade to Mattermost Desktop App versions higher than 5.8.0 to address this vulnerability (NVD).