← Back

CVE-2024-47003

nvd nist
Published: Sep 26, 2024Modified: Sep 26, 2024

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.

Affected (5)

Mattermost
1 product
Mattermost Server
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost
Mattermost Server
From 9.5.0 to 9.5.9
Mattermost Server
Version 9.11.0
Mattermost Server
Version 9.11.0 rc1
Mattermost Server
Version 9.11.0 rc2
Mattermost Server
Version 9.11.0 rc3

Related CWEs

CWE-400
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (1)

Source: responsibledisclosure@mattermost.com
Vendor Advisory

Timeline

No history available yet.