medium4.3
CVE-2024-28949
Mattermost Server doesn't limit the number of user preferences
Impact
Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/v8 | >= 8.1.0, < 8.1.11 | 8.1.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | from 8.1.0 before 8.1.11 from 9.3.0 before 9.3.3 from 9.4.0 before 9.4.4 from 9.5.0 before 9.5.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://mattermost.com/security-updates
- https://github.com/advisories/GHSA-mcw6-3256-64gg
- https://nvd.nist.gov/vuln/detail/CVE-2024-28949
- https://github.com/mattermost/mattermost/commit/11a21f4da352a472a09de3b8e125514750a6619a
- https://github.com/mattermost/mattermost/commit/362b7d29d35c00fe80721d3d47442a4f3168eb2b
- https://github.com/mattermost/mattermost/commit/5632d6b4ff6d019a21bb8ddd037d4a931cd85ae2
- https://github.com/mattermost/mattermost/commit/88f9285173dc4cb35fa19a8b8604e098a567f704
- https://pkg.go.dev/vuln/GO-2024-2695