CVE-2024-1402

Published: Feb 9, 2024Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post.

Affected (3)

Products: Mattermost: Mattermost Server

1 product

Mattermost Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mattermost Mattermost Server	Up to 8.1.7
Mattermost Mattermost Server	From 9.0.0 to 9.1.4
Mattermost Mattermost Server	From 9.2.0 to 9.2.3

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (2)

https://mattermost.com/security-updates

Source: responsibledisclosure@mattermost.com

Vendor Advisory

https://mattermost.com/security-updates

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.