CVE-2024-47003 — Uncontrolled Resource Consumption in Mattermost Mattermost Server V8

CWE-400 — Uncontrolled Resource Consumption5 documents4 sources
Severity
6.5MEDIUMNVD
CNA3.1
EPSS
0.5%
top 34.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Mattermost Mattermost Server V8Mattermost ServerMattermost
Timeline
PublishedSep 26
Latest updateOct 10

Description

Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDmattermost/mattermost_server9.5.0 — 9.5.9+1
▶Gogithub.com/mattermost_mattermost_server_v8< 8.0.0-20240806094731-69a8b3df0f9f
▶CVEListV5mattermost/mattermost9.5.0 — 9.5.8+1

🔴Vulnerability Details

4
OSV
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events in github.com/mattermost/mattermost-server↗2024-10-10
▶
OSV
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events↗2024-09-26
▶
CVEList
DoS via non-string message using permalink embed↗2024-09-26
▶
GHSA
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events↗2024-09-26
▶
CVE-2024-47003 — Uncontrolled Resource Consumption | cvebase