CVE-2024-32945
Mattermost Mobile ≤ 2.17.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:NSummary
CVE-2024-32945 is a low-severity Missing Initialization of Resource (CWE-909) vulnerability in Mattermost Mattermost Mobile. Its CVSS base score is 2.6 (Low).
Operationally, ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34471
Vulnerability Data
Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a LateX post, by creating another post with specific macro definitions.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing initialization through static analysis or test cases.
Documented development standards and processes can mandate initialization of critical resources.
Security engineering principles can require explicit resource initialization during design and coding.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper resource initialization as part of coding standards and verification.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing initialization defects before deployment.
Secure development life cycle mandates initialization of resources before use.
Application security requirements can specify resource initialization checks.
Secure architecture principles include proper resource lifecycle management.
Secure coding standards explicitly require initialization of variables and resources.
Change management can enforce review of initialization logic during modifications.