CVE-2024-1402
Medium
Description
Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Mattermost Server
PublishedFeb 9, 2024
First seenFeb 9, 2024
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- github.com/mattermost/mattermost/server/v88.1.8, 9.2.4, 9.1.5 or later
- github.com/mattermost/mattermost-server9.1.5+incompatible, 9.2.4+incompatible or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mattermost mattermost_server | v ≤ 8.1.7, 9.0.0 ≤ v ≤ 9.1.4, 9.2.0 ≤ v ≤ 9.2.3 | — |
| github.com/mattermost/mattermost/server/v8Go | v < 8.1.8, 9.2.0 ≤ v < 9.2.4, 9.1.0 ≤ v < 9.1.5, No range specified | 8.1.8, 9.2.4, 9.1.5 |
| github.com/mattermost/mattermost-serverGo | 9.1.0+incompatible ≤ v < 9.1.5+incompatible, 9.2.0+incompatible ≤ v < 9.2.4+incompatible | 9.1.5+incompatible, 9.2.4+incompatible |
| github.com/mattermost/mattermost-server/v5Go | No range specified | — |
| github.com/mattermost/mattermost-server/v6Go | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.