PT-2024-22638 · Mattermost · Mattermost Server

Vultza · Published 2024-04-05 · Updated 2024-12-13 · CVE-2024-28949

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost Server versions 8.1.x through 8.1.10 Mattermost Server versions 9.3.x through 9.3.2 Mattermost Server versions 9.4.x through 9.4.3 Mattermost Server versions 9.5.x through 9.5.1

Description The issue arises because Mattermost Server does not limit the number of user preferences, allowing an attacker to send a large number of user preferences, potentially causing denial of service.

Recommendations For versions 8.1.x through 8.1.10, update to version 8.1.11 or later. For versions 9.3.x through 9.3.2, update to version 9.3.3 or later. For versions 9.4.x through 9.4.3, update to version 9.4.4 or later. For versions 9.5.x through 9.5.1, update to version 9.5.2 or later.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BIT-MATTERMOST-2024-28949

CVE-2024-28949

GHSA-MCW6-3256-64GG

GO-2024-2695

Affected Products

Mattermost Server

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2024-28949 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28949 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mcw6-3256-64gg · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2024-28949 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2695 · Vendor Advisory
• https://github.com/mattermost/mattermost/commit/11a21f4da352a472a09de3b8e125514750a6619a · Note
• https://github.com/mattermost/mattermost/commit/88f9285173dc4cb35fa19a8b8604e098a567f704 · Note
• https://github.com/mattermost/mattermost/commit/362b7d29d35c00fe80721d3d47442a4f3168eb2b · Note
• https://github.com/mattermost/mattermost/commit/5632d6b4ff6d019a21bb8ddd037d4a931cd85ae2 · Note
• https://twitter.com/VulmonFeeds/status/1776197471049281852 · Twitter Post
• https://t.me/cvenotify/104111 · Telegram Post
• https://github.com/advisories/GHSA-mcw6-3256-64gg · Note
• https://pkg.go.dev/vuln/GO-2024-2695 · Note