Lucene search

MattermostCVE-2024-2446

HistoryMar 15, 2024 - 10:15 a.m.

CVE-2024-2446

2024-03-1510:15:08

CWE-400

Mattermost

web.nvd.nist.gov

mattermost

cve-2024-2446

security vulnerability

client crash

authentication

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

4.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "9.4.2",
        "status": "affected",
        "version": "9.4.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.3.1",
        "status": "affected",
        "version": "9.3.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.2.5",
        "status": "affected",
        "version": "9.2.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.1.9",
        "status": "affected",
        "version": "8.1.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "9.5.0"
      },
      {
        "status": "unaffected",
        "version": "9.4.3"
      },
      {
        "status": "unaffected",
        "version": "9.3.2"
      },
      {
        "status": "unaffected",
        "version": "9.2.6"
      },
      {
        "status": "unaffected",
        "version": "8.1.10"
      }
    ]
  }
]

References

mattermost.com/security-updates

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

4.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-2446