CVE-2024-1402
Published: Feb 9, 2024
Modified: Aug 1, 2024
CVSS v3.1
4.3
Description
Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post.
| Vendor | Product | Versions |
|---|---|---|
Mattermost | Mattermost | affected 0 - <= 8.1.7affected 0 - <= 9.1.4affected 0 - <= 9.2.3unaffected 9.3.0unaffected 9.2.4+2 more versions |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now