PT-2024-29586 · Mattermost · Mattermost

Juho Nurminen · Published 2024-04-26 · Updated 2024-06-05 · CVE-2024-4182

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mattermost versions 8.1.x through 8.1.11 Mattermost versions 9.4.x through 9.4.4 Mattermost versions 9.5.x through 9.5.2 Mattermost version 9.6.0

Description The issue arises from the failure to handle JSON parsing errors in custom status values, allowing an authenticated attacker to crash other users' web clients via a malformed custom status.

Recommendations For Mattermost versions 8.1.x through 8.1.11, update to version 8.1.12 or later. For Mattermost versions 9.4.x through 9.4.4, update to version 9.4.5 or later. For Mattermost versions 9.5.x through 9.5.2, update to version 9.5.3 or later. For Mattermost version 9.6.0, update to a version that includes the fix for this issue.

Fix

DoS

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2024-4182

GHSA-8F99-G2PJ-X8W3

GO-2024-2795

Affected Products

Mattermost

References · 13

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4182 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4182 · Security Note
• https://osv.dev/vulnerability/GO-2024-2795 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8f99-g2pj-x8w3 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/a99dadd80c57d376185ca06f8f70919a6f135bc6 · Note
• https://github.com/mattermost/mattermost/commit/6cbab0f7ece104681f73dd12c75d9f22d567125e · Note
• https://github.com/mattermost/mattermost/commit/f84f8ed65f6a5faba974426424b684635455a527 · Note
• https://github.com/mattermost/mattermost/commit/41333a0babf565453d89287549bec1e546e75ce7 · Note
• https://github.com/advisories/GHSA-8f99-g2pj-x8w3 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4182 · Note
• https://twitter.com/VulmonFeeds/status/1783810774571343915 · Twitter Post