Vulnerability-Lookup

CVE-2024-22091 (GCVE-0-2024-22091)

Vulnerability from cvelistv5 – Published: 2024-04-26 08:24 – Updated: 2024-08-01 22:35

Title

Excessive resource consumption due to lack to request path size limits

Summary

Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-26 14:47 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

Mattermost mitre root

References

1 reference

URL	Tags
https://mattermost.com/security-updates

Impacted products

5 products

Vendor	Product	Version	CPE status
Mattermost	Mattermost	Affected: 8.1.0 , ≤ 8.1.10 (semver) Affected: 9.6.0 Affected: 9.5.0 , ≤ 9.5.2 (semver) Affected: 8.1.0 , ≤ 8.1.11 (semver) Unaffected: 9.7.0 Unaffected: 8.1.11 Unaffected: 9.6.1 Unaffected: 9.5.3 Unaffected: 8.1.12	guessed
mattermost	mattermost_server	Affected: 8.1x cpe:2.3:a:mattermost:mattermost_server:-:::::::*
mattermost	mattermost	Affected: 9.6x cpe:2.3:a:mattermost:mattermost:-:::::::*
mattermost	mattermost	Affected: 9.5x cpe:2.3:a:mattermost:mattermost:-:::::::*
mattermost	mattermost	Affected: 8.1x cpe:2.3:a:mattermost:mattermost:-:::::::*

Credits

Veshraj Ghimire (ghimire_veshraj)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mattermost:mattermost_server:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mattermost_server",
            "vendor": "mattermost",
            "versions": [
              {
                "status": "affected",
                "version": "8.1x"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mattermost",
            "vendor": "mattermost",
            "versions": [
              {
                "status": "affected",
                "version": "9.6x"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mattermost",
            "vendor": "mattermost",
            "versions": [
              {
                "status": "affected",
                "version": "9.5x"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mattermost",
            "vendor": "mattermost",
            "versions": [
              {
                "status": "affected",
                "version": "8.1x"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22091",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-26T14:47:29.118846Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:52:42.979Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.806Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://mattermost.com/security-updates"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "8.1.10",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "9.6.0"
            },
            {
              "lessThanOrEqual": "9.5.2",
              "status": "affected",
              "version": "9.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.11",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "9.7.0"
            },
            {
              "status": "unaffected",
              "version": "8.1.11"
            },
            {
              "status": "unaffected",
              "version": "9.6.1"
            },
            {
              "status": "unaffected",
              "version": "9.5.3"
            },
            {
              "status": "unaffected",
              "version": "8.1.12"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Veshraj Ghimire (ghimire_veshraj)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMattermost versions 8.1.x \u0026lt;= 8.1.10, 9.6.x \u0026lt;= 9.6.0, 9.5.x \u0026lt;= 9.5.2 and 8.1.x \u0026lt;= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;excessive resource\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003econsumption\u003c/span\u003e, possibly leading to a DoS\u003c/span\u003e\u0026nbsp;via sending large request paths\u003c/p\u003e"
            }
          ],
          "value": "Mattermost versions 8.1.x \u003c= 8.1.10, 9.6.x \u003c= 9.6.0, 9.5.x \u003c= 9.5.2 and 8.1.x \u003c= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u00a0excessive resource\u00a0consumption, possibly leading to a DoS\u00a0via sending large request paths\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-26T08:24:34.049Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate Mattermost to versions 9.7.0, 8.1.11, 9.6.1, 9.5.3, 8.1.12 or higher.\u003c/p\u003e"
            }
          ],
          "value": "Update Mattermost to versions 9.7.0, 8.1.11, 9.6.1, 9.5.3, 8.1.12 or higher.\n\n"
        }
      ],
      "source": {
        "advisory": "MMSA-2024-00308",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-56708"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Excessive resource consumption due to lack to request path size limits",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2024-22091",
    "datePublished": "2024-04-26T08:24:34.049Z",
    "dateReserved": "2024-04-10T09:53:47.697Z",
    "dateUpdated": "2024-08-01T22:35:34.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-22091",
      "date": "2026-09-19",
      "epss": "0.00537",
      "percentile": "0.44189"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost versions 8.1.x \u003c= 8.1.10, 9.6.x \u003c= 9.6.0, 9.5.x \u003c= 9.5.2 and 8.1.x \u003c= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u00a0excessive resource\u00a0consumption, possibly leading to a DoS\u00a0via sending large request paths\n\n"
        },
        {
          "lang": "es",
          "value": "Las versiones Mattermost 8.1.x \u0026lt;= 8.1.10, 9.6.x \u0026lt;= 9.6.0, 9.5.x \u0026lt;= 9.5.2 y 8.1.x \u0026lt;= 8.1.11 no limitan el tama\u00f1o de una ruta de solicitud que incluye entradas del usuario que permiten a un atacante causar un consumo excesivo de recursos, lo que posiblemente lleve a un DoS mediante el env\u00edo de grandes rutas de solicitud"
        }
      ],
      "id": "CVE-2024-22091",
      "lastModified": "2024-11-21T08:55:33.560",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 3.1,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 1.6,
            "impactScore": 1.4,
            "source": "responsibledisclosure@mattermost.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-04-26T09:15:11.880",
      "references": [
        {
          "source": "responsibledisclosure@mattermost.com",
          "url": "https://mattermost.com/security-updates"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "sourceIdentifier": "responsibledisclosure@mattermost.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-400"
            }
          ],
          "source": "responsibledisclosure@mattermost.com",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Mattermost",
                "vendor": "Mattermost",
                "versions": [
                  {
                    "lessThanOrEqual": "8.1.10",
                    "status": "affected",
                    "version": "8.1.0",
                    "versionType": "semver"
                  },
                  {
                    "status": "affected",
                    "version": "9.6.0"
                  },
                  {
                    "lessThanOrEqual": "9.5.2",
                    "status": "affected",
                    "version": "9.5.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.1.11",
                    "status": "affected",
                    "version": "8.1.0",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "9.7.0"
                  },
                  {
                    "status": "unaffected",
                    "version": "8.1.11"
                  },
                  {
                    "status": "unaffected",
                    "version": "9.6.1"
                  },
                  {
                    "status": "unaffected",
                    "version": "9.5.3"
                  },
                  {
                    "status": "unaffected",
                    "version": "8.1.12"
                  }
                ]
              }
            ],
            "source": "responsibledisclosure@mattermost.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:mattermost:mattermost_server:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mattermost_server",
                "vendor": "mattermost",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.1x"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mattermost",
                "vendor": "mattermost",
                "versions": [
                  {
                    "status": "affected",
                    "version": "9.6x"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mattermost",
                "vendor": "mattermost",
                "versions": [
                  {
                    "status": "affected",
                    "version": "9.5x"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mattermost",
                "vendor": "mattermost",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.1x"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "78A6C1F3-95B8-4231-B5D8-C8BB65EA9BFB",
                    "versionEndExcluding": "8.1.12",
                    "versionStartIncluding": "8.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D4846F2D-56D5-4D24-BF0D-2075072A6ADF",
                    "versionEndExcluding": "9.5.3",
                    "versionStartIncluding": "9.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F4540F56-1DA0-407F-A909-335D8DF3193C",
                    "versionEndExcluding": "9.6.1",
                    "versionStartIncluding": "9.6.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Mattermost versions 8.1.x \u003c= 8.1.10, 9.6.x \u003c= 9.6.0, 9.5.x \u003c= 9.5.2 and 8.1.x \u003c= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u00a0excessive resource\u00a0consumption, possibly leading to a DoS\u00a0via sending large request paths\n\n"
          },
          {
            "lang": "es",
            "value": "Las versiones Mattermost 8.1.x \u0026lt;= 8.1.10, 9.6.x \u0026lt;= 9.6.0, 9.5.x \u0026lt;= 9.5.2 y 8.1.x \u0026lt;= 8.1.11 no limitan el tama\u00f1o de una ruta de solicitud que incluye entradas del usuario que permiten a un atacante causar un consumo excesivo de recursos, lo que posiblemente lleve a un DoS mediante el env\u00edo de grandes rutas de solicitud"
          }
        ],
        "id": "CVE-2024-22091",
        "lastModified": "2026-06-17T07:10:41.830",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 1.4,
              "source": "responsibledisclosure@mattermost.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-22091",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-26T14:47:29.118846Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-26T09:15:11.880",
        "references": [
          {
            "source": "responsibledisclosure@mattermost.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://mattermost.com/security-updates"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://mattermost.com/security-updates"
          }
        ],
        "sourceIdentifier": "responsibledisclosure@mattermost.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "responsibledisclosure@mattermost.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-17T14:02:05+00:00",
      "cve": "CVE-2024-22091",
      "id": "CVE-2024-22091",
      "initial_release_date": "2024-04-26T00:00:00+00:00",
      "product_status:known_affected": "7",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "mattermost: fail to limit the size of a request path causing excessive resource\u00a0consumption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-22091.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-01T22:35:34.806Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://mattermost.com/security-updates"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:mattermost:mattermost_server:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mattermost_server",
                "vendor": "mattermost",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.1x"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mattermost",
                "vendor": "mattermost",
                "versions": [
                  {
                    "status": "affected",
                    "version": "9.6x"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mattermost",
                "vendor": "mattermost",
                "versions": [
                  {
                    "status": "affected",
                    "version": "9.5x"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mattermost",
                "vendor": "mattermost",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.1x"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-22091",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-04-26T14:47:29.118846Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-04-26T14:46:31.965Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "8.1.10",
                  "status": "affected",
                  "version": "8.1.0",
                  "versionType": "semver"
                },
                {
                  "status": "affected",
                  "version": "9.6.0"
                },
                {
                  "lessThanOrEqual": "9.5.2",
                  "status": "affected",
                  "version": "9.5.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.1.11",
                  "status": "affected",
                  "version": "8.1.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "9.7.0"
                },
                {
                  "status": "unaffected",
                  "version": "8.1.11"
                },
                {
                  "status": "unaffected",
                  "version": "9.6.1"
                },
                {
                  "status": "unaffected",
                  "version": "9.5.3"
                },
                {
                  "status": "unaffected",
                  "version": "8.1.12"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Veshraj Ghimire (ghimire_veshraj)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eMattermost versions 8.1.x \u0026lt;= 8.1.10, 9.6.x \u0026lt;= 9.6.0, 9.5.x \u0026lt;= 9.5.2 and 8.1.x \u0026lt;= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;excessive resource\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003econsumption\u003c/span\u003e, possibly leading to a DoS\u003c/span\u003e\u0026nbsp;via sending large request paths\u003c/p\u003e"
                }
              ],
              "value": "Mattermost versions 8.1.x \u003c= 8.1.10, 9.6.x \u003c= 9.6.0, 9.5.x \u003c= 9.5.2 and 8.1.x \u003c= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u00a0excessive resource\u00a0consumption, possibly leading to a DoS\u00a0via sending large request paths\n\n"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400: Uncontrolled Resource Consumption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-04-26T08:24:34.049Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eUpdate Mattermost to versions 9.7.0, 8.1.11, 9.6.1, 9.5.3, 8.1.12 or higher.\u003c/p\u003e"
                }
              ],
              "value": "Update Mattermost to versions 9.7.0, 8.1.11, 9.6.1, 9.5.3, 8.1.12 or higher.\n\n"
            }
          ],
          "source": {
            "advisory": "MMSA-2024-00308",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-56708"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Excessive resource consumption due to lack to request path size limits",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2024-22091",
        "datePublished": "2024-04-26T08:24:34.049Z",
        "dateReserved": "2024-04-10T09:53:47.697Z",
        "dateUpdated": "2024-08-01T22:35:34.806Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CNVD-2024-26108

Vulnerability from cnvd - Published: 2024-06-07

Title

Mattermost Server未控制的资源消耗漏洞

Description

Mattermost Server是美国Mattermost公司的一套开源的消息传递平台。 Mattermost Server存在未控制的资源消耗漏洞，攻击者可利用该漏洞通过发送大的请求路径导致拒绝服务。

Severity

低

Patch Name

Mattermost Server未控制的资源消耗漏洞的补丁

Patch Description

Mattermost Server是美国Mattermost公司的一套开源的消息传递平台。 Mattermost Server存在未控制的资源消耗漏洞，攻击者可利用该漏洞通过发送大的请求路径导致拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://mattermost.com/security-updates/

Reference

https://cxsecurity.com/cveshow/CVE-2024-22091/

Impacted products

Name
['Mattermost Mattermost Server 9.6.，<=9.6.0', 'Mattermost Mattermost Server 9.5.，<=9.5.2', 'Mattermost Mattermost Server 8.1.*，<=8.1.11']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-22091"
    }
  },
  "description": "Mattermost Server\u662f\u7f8e\u56fdMattermost\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u6d88\u606f\u4f20\u9012\u5e73\u53f0\u3002\n\nMattermost Server\u5b58\u5728\u672a\u63a7\u5236\u7684\u8d44\u6e90\u6d88\u8017\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d1\u9001\u5927\u7684\u8bf7\u6c42\u8def\u5f84\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://mattermost.com/security-updates/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-26108",
  "openTime": "2024-06-07",
  "patchDescription": "Mattermost Server\u662f\u7f8e\u56fdMattermost\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u6d88\u606f\u4f20\u9012\u5e73\u53f0\u3002\r\n\r\nMattermost Server\u5b58\u5728\u672a\u63a7\u5236\u7684\u8d44\u6e90\u6d88\u8017\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d1\u9001\u5927\u7684\u8bf7\u6c42\u8def\u5f84\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Mattermost Server\u672a\u63a7\u5236\u7684\u8d44\u6e90\u6d88\u8017\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Mattermost Mattermost Server 9.6.*\uff0c\u003c=9.6.0",
      "Mattermost Mattermost Server 9.5.*\uff0c\u003c=9.5.2",
      "Mattermost Mattermost Server 8.1.*\uff0c\u003c=8.1.11"
    ]
  },
  "referenceLink": "https://cxsecurity.com/cveshow/CVE-2024-22091/",
  "serverity": "\u4f4e",
  "submitTime": "2024-04-29",
  "title": "Mattermost Server\u672a\u63a7\u5236\u7684\u8d44\u6e90\u6d88\u8017\u6f0f\u6d1e"
}

FKIE_CVE-2024-22091

Vulnerability from fkie_nvd - Published: 2024-04-26 09:15 - Updated: 2026-06-17 07:10

Severity

3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	responsibledisclosure@mattermost.com	https://mattermost.com/security-updates	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://mattermost.com/security-updates	Vendor Advisory

Impacted products

Vendor	Product	Version
mattermost	mattermost_server	*
mattermost	mattermost_server	*
mattermost	mattermost_server	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "8.1.10",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "9.6.0"
            },
            {
              "lessThanOrEqual": "9.5.2",
              "status": "affected",
              "version": "9.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.11",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "9.7.0"
            },
            {
              "status": "unaffected",
              "version": "8.1.11"
            },
            {
              "status": "unaffected",
              "version": "9.6.1"
            },
            {
              "status": "unaffected",
              "version": "9.5.3"
            },
            {
              "status": "unaffected",
              "version": "8.1.12"
            }
          ]
        }
      ],
      "source": "responsibledisclosure@mattermost.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost_server:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "mattermost_server",
          "vendor": "mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "8.1x"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "mattermost",
          "vendor": "mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "9.6x"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "mattermost",
          "vendor": "mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "9.5x"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "mattermost",
          "vendor": "mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "8.1x"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "78A6C1F3-95B8-4231-B5D8-C8BB65EA9BFB",
              "versionEndExcluding": "8.1.12",
              "versionStartIncluding": "8.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4846F2D-56D5-4D24-BF0D-2075072A6ADF",
              "versionEndExcluding": "9.5.3",
              "versionStartIncluding": "9.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4540F56-1DA0-407F-A909-335D8DF3193C",
              "versionEndExcluding": "9.6.1",
              "versionStartIncluding": "9.6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mattermost versions 8.1.x \u003c= 8.1.10, 9.6.x \u003c= 9.6.0, 9.5.x \u003c= 9.5.2 and 8.1.x \u003c= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u00a0excessive resource\u00a0consumption, possibly leading to a DoS\u00a0via sending large request paths\n\n"
    },
    {
      "lang": "es",
      "value": "Las versiones Mattermost 8.1.x \u0026lt;= 8.1.10, 9.6.x \u0026lt;= 9.6.0, 9.5.x \u0026lt;= 9.5.2 y 8.1.x \u0026lt;= 8.1.11 no limitan el tama\u00f1o de una ruta de solicitud que incluye entradas del usuario que permiten a un atacante causar un consumo excesivo de recursos, lo que posiblemente lleve a un DoS mediante el env\u00edo de grandes rutas de solicitud"
    }
  ],
  "id": "CVE-2024-22091",
  "lastModified": "2026-06-17T07:10:41.830",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "responsibledisclosure@mattermost.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22091",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-04-26T14:47:29.118846Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-04-26T09:15:11.880",
  "references": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://mattermost.com/security-updates"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "responsibledisclosure@mattermost.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-P2WQ-4GGP-45F3

Vulnerability from github – Published: 2024-04-26 09:30 – Updated: 2025-05-12 21:50

Summary

Mattermost fails to limit the size of a request path

Details

Severity

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.1.11"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.0"
            },
            {
              "fixed": "8.1.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.5.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.5.0"
            },
            {
              "fixed": "9.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.6.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.6.0-rc1"
            },
            {
              "fixed": "9.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-22091"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-26T19:11:28Z",
    "nvd_published_at": "2024-04-26T09:15:11Z",
    "severity": "LOW"
  },
  "details": "Mattermost versions 8.1.x \u003c= 8.1.10, 9.6.x \u003c= 9.6.0, 9.5.x \u003c= 9.5.2 and 8.1.x \u003c= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u00a0excessive resource\u00a0consumption, possibly leading to a DoS\u00a0via sending large request paths",
  "id": "GHSA-p2wq-4ggp-45f3",
  "modified": "2025-05-12T21:50:10Z",
  "published": "2024-04-26T09:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22091"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/13049d8b16b195f98246dff4812b5f64c1e5a627"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/49e7c477246e31c7a0bd85c1043599121755b260"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/54478f2ccbc6c4f110706966adfe0db2c16a566c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/f6d320017549ec66efb5fdd4bc10b66ab36abb70"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mattermost/mattermost"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mattermost fails to limit the size of a request path"
}

GSD-2024-22091

Vulnerability from gsd - Updated: 2024-04-11 05:03

Details

Aliases

CVE-2024-22091

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-22091"
      ],
      "details": "Mattermost versions 8.1.x \u003c= 8.1.10, 9.6.x \u003c= 9.6.0, 9.5.x \u003c= 9.5.2 and 8.1.x \u003c= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u00a0excessive resource\u00a0consumption, possibly leading to a DoS\u00a0via sending large request paths\n\n",
      "id": "GSD-2024-22091",
      "modified": "2024-04-11T05:03:23.914820Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "responsibledisclosure@mattermost.com",
        "ID": "CVE-2024-22091",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Mattermost",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThanOrEqual": "8.1.10",
                                "status": "affected",
                                "version": "8.1.0",
                                "versionType": "semver"
                              },
                              {
                                "status": "affected",
                                "version": "9.6.0"
                              },
                              {
                                "lessThanOrEqual": "9.5.2",
                                "status": "affected",
                                "version": "9.5.0",
                                "versionType": "semver"
                              },
                              {
                                "lessThanOrEqual": "8.1.11",
                                "status": "affected",
                                "version": "8.1.0",
                                "versionType": "semver"
                              },
                              {
                                "status": "unaffected",
                                "version": "9.7.0"
                              },
                              {
                                "status": "unaffected",
                                "version": "8.1.11"
                              },
                              {
                                "status": "unaffected",
                                "version": "9.6.1"
                              },
                              {
                                "status": "unaffected",
                                "version": "9.5.3"
                              },
                              {
                                "status": "unaffected",
                                "version": "8.1.12"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Mattermost"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Veshraj Ghimire (ghimire_veshraj)"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Mattermost versions 8.1.x \u003c= 8.1.10, 9.6.x \u003c= 9.6.0, 9.5.x \u003c= 9.5.2 and 8.1.x \u003c= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u00a0excessive resource\u00a0consumption, possibly leading to a DoS\u00a0via sending large request paths\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-400",
                "lang": "eng",
                "value": "CWE-400: Uncontrolled Resource Consumption"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://mattermost.com/security-updates",
            "refsource": "MISC",
            "url": "https://mattermost.com/security-updates"
          }
        ]
      },
      "solution": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate Mattermost to versions 9.7.0, 8.1.11, 9.6.1, 9.5.3, 8.1.12 or higher.\u003c/p\u003e"
            }
          ],
          "value": "Update Mattermost to versions 9.7.0, 8.1.11, 9.6.1, 9.5.3, 8.1.12 or higher.\n\n"
        }
      ],
      "source": {
        "advisory": "MMSA-2024-00308",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-56708"
        ],
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "Mattermost versions 8.1.x \u003c= 8.1.10, 9.6.x \u003c= 9.6.0, 9.5.x \u003c= 9.5.2 and 8.1.x \u003c= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause\u00a0excessive resource\u00a0consumption, possibly leading to a DoS\u00a0via sending large request paths\n\n"
          },
          {
            "lang": "es",
            "value": "Las versiones Mattermost 8.1.x \u0026lt;= 8.1.10, 9.6.x \u0026lt;= 9.6.0, 9.5.x \u0026lt;= 9.5.2 y 8.1.x \u0026lt;= 8.1.11 no limitan el tama\u00f1o de una ruta de solicitud que incluye entradas del usuario que permiten a un atacante causar un consumo excesivo de recursos, lo que posiblemente lleve a un DoS mediante el env\u00edo de grandes rutas de solicitud"
          }
        ],
        "id": "CVE-2024-22091",
        "lastModified": "2024-04-26T12:58:17.720",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 1.4,
              "source": "responsibledisclosure@mattermost.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-26T09:15:11.880",
        "references": [
          {
            "source": "responsibledisclosure@mattermost.com",
            "url": "https://mattermost.com/security-updates"
          }
        ],
        "sourceIdentifier": "responsibledisclosure@mattermost.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "responsibledisclosure@mattermost.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

WID-SEC-W-2024-0718

Vulnerability from csaf_certbund - Published: 2024-03-26 23:00 - Updated: 2024-04-28 22:00

Summary

Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Severity

Mittel

Scope

6 vulnerabilities in this advisory, including CVE-2024-22091.

CVE-2024-22091

Es existieren mehrere Schwachstellen in Mattermost, die zum aktuellen Zeitpunkt nicht im Detail beschrieben und veröffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht näher spezifizierte Auswirkungen zu verursachen.

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-22091 (GCVE-0-2024-22091)

CNVD-2024-26108

FKIE_CVE-2024-22091

GHSA-P2WQ-4GGP-45F3

GSD-2024-22091

WID-SEC-W-2024-0718

Tags

Sightings

Nomenclature

Related by attack behaviour