Incorrect Session Creation with Desktop SSO
Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.
02 / AFFECTED SOFTWARE
Affected packages
34 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.
Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 incorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.
Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server
05 / REFERENCES
Further evidence
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10214.json
- https://mattermost.com/security-updates
- https://nvd.nist.gov/vuln/detail/CVE-2024-10214
- https://github.com/advisories/GHSA-hm57-h27x-599c
- https://github.com/mattermost/mattermost
- https://github.com/mattermost/mattermost/commit/0d6b1070a26f0b9fc13f7e7fbbe18b6a31570c5a