GitHub Advisoryadvisory · Go

GHSA-mcw6-3256-64gg Mattermost Server doesn't limit the number of user preferences

MEDIUM Published 2024-04-05 Modified 2024-12-13 Official page ↗
Aliases
CVE-2024-28949
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-770
Reviewed
2024-04-05

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 8.1.0, < 8.1.11 → fixed in 8.1.11 • Go github.com/mattermost/mattermost/server/v8: >= 9.3.0, < 9.3.3 → fixed in 9.3.3 • Go github.com/mattermost/mattermost/server/v8: >= 9.4.0, < 9.4.4 → fixed in 9.4.4 • Go github.com/mattermost/mattermost/server/v8: >= 9.5.0, < 9.5.2 → fixed in 9.5.2

Description

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

Related

Alias · CVE (1)

  • CVE-2024-28949 Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References