GHSA-vm9m-57jr-4pxh

ghsaUSosv

Mattermost fails to limit the number of role names

view advisory published 2024-02-29Licence: CC-BY-4.0

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-1953US	medium4.3	0.51% (43rd)	—	2024-02-29
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated a…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2024-1953ADVISORY
https://pkg.go.dev/vuln/GO-2024-2594WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan