Lucene search

GoogleOSV:GHSA-MCW6-3256-64GG

HistoryApr 05, 2024 - 9:30 a.m.

Mattermost Server doesn't limit the number of user preferences

2024-04-0509:30:39

Google

osv.dev

mattermost server

user preferences

denial of service

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

6.7

Confidence

High

EPSS

Percentile

9.0%

JSON

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don’t limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

References

github.com/mattermost/mattermost/commit/11a21f4da352a472a09de3b8e125514750a6619a

github.com/mattermost/mattermost/commit/362b7d29d35c00fe80721d3d47442a4f3168eb2b

github.com/mattermost/mattermost/commit/5632d6b4ff6d019a21bb8ddd037d4a931cd85ae2

github.com/mattermost/mattermost/commit/88f9285173dc4cb35fa19a8b8604e098a567f704

mattermost.com/security-updates

nvd.nist.gov/vuln/detail/CVE-2024-28949

mattermost/mattermost

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

6.7

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for OSV:GHSA-MCW6-3256-64GG