PT-2024-19200 · Mattermost · Mattermost

Veshraj Ghimire · Published 2024-04-26 · Updated 2024-06-05 · CVE-2024-22091

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 8.1.x through 8.1.11 Mattermost versions 9.5.x through 9.5.2 Mattermost versions 9.6.x through 9.6.0

Description The issue arises from the failure to limit the size of a request path that includes user inputs, allowing an attacker to cause excessive resource consumption, possibly leading to a denial of service (DoS) via sending large request paths. This affects the Mattermost server, specifically the request path handling.

Recommendations For versions 8.1.x through 8.1.11, update to a version later than 8.1.11 to resolve the issue. For versions 9.5.x through 9.5.2, update to a version later than 9.5.2 to resolve the issue. For versions 9.6.x through 9.6.0, update to a version later than 9.6.0 to resolve the issue.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2024-22091

GHSA-P2WQ-4GGP-45F3

GO-2024-2796

Affected Products

Mattermost

References · 13

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22091 · Security Note
• https://osv.dev/vulnerability/GO-2024-2796 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22091 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p2wq-4ggp-45f3 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/f6d320017549ec66efb5fdd4bc10b66ab36abb70 · Note
• https://github.com/mattermost/mattermost/commit/13049d8b16b195f98246dff4812b5f64c1e5a627 · Note
• https://github.com/mattermost/mattermost/commit/54478f2ccbc6c4f110706966adfe0db2c16a566c · Note
• https://github.com/mattermost/mattermost/commit/49e7c477246e31c7a0bd85c1043599121755b260 · Note
• https://twitter.com/VulmonFeeds/status/1783811533442589174 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22091 · Note
• https://github.com/advisories/GHSA-p2wq-4ggp-45f3 · Note