PT-2024-20683 · Mattermost · Mattermost Mobile

Gian Klug · Published 2024-03-15 · Updated 2025-01-21 · CVE-2024-24975

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost Mobile versions prior to 2.13.0

Description The issue is related to uncontrolled resource consumption, where the syntax highlighter fails to limit the size of the code block it processes. This allows an attacker to send a very large code block, potentially crashing the mobile app.

Recommendations For versions prior to 2.13.0, update to version 2.13.0 or later to resolve the issue. As a temporary workaround, consider restricting the size of code blocks that can be processed by the syntax highlighter to prevent excessive resource consumption.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-24975

Affected Products

Mattermost Mobile

References · 8

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24975 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24975 · Vendor Advisory
• https://twitter.com/CVEnew/status/1768569172961743046 · Twitter Post
• https://t.me/cvenotify/108096 · Telegram Post
• https://twitter.com/Esparta6108713/status/1768568666554044549 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1768623634128453640 · Twitter Post
• https://t.me/cvenotify/73877 · Telegram Post