Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2024-28949

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

VectorNETWORK

PublishedApr 05, 2024, 09:15

Published Byresponsibledisclosure@mattermost.com

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/mattermost/mattermost/server/v8(Go)8.1.08.1.11N/A

github.com/mattermost/mattermost/server/v8(Go)9.3.09.3.3N/A

github.com/mattermost/mattermost/server/v8(Go)9.4.09.4.4N/A

github.com/mattermost/mattermost/server/v8(Go)9.5.09.5.2N/A

References

https://mattermost.com/security-updates

Weakness Type

CWE-770

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK