GitHub Advisoryadvisory · Go

GHSA-wj37-mpq9-xrcm Mattermost fails to limit the number of active sessions

MEDIUM Published 2024-04-26 Modified 2025-05-12 Official page ↗
Aliases
CVE-2024-4183
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-770
Reviewed
2024-04-26

Affected packages

• Go github.com/mattermost/mattermost-server: >= 9.6.0-rc1, < 9.6.1 → fixed in 9.6.1 • Go github.com/mattermost/mattermost-server: >= 9.5.0, < 9.5.3 → fixed in 9.5.3 • Go github.com/mattermost/mattermost-server: >= 9.4.0, < 9.4.5 → fixed in 9.4.5 • Go github.com/mattermost/mattermost-server: >= 8.1.0, < 8.1.12 → fixed in 8.1.12

Description

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.

Related

Alias · CVE (1)

  • CVE-2024-4183 Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References