Servers and applications
CVE-2024-45843
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.
- Severity
- Medium 5.4
- Published
- 26 Sept 2024
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 9.5.9
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MattermostServers and applications · cpe:a:mattermost:mattermost_server |
|