CVE-2024-28949mediumCWE-400

DoS via a large number of User Preferences

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.6%

exploitation probability

0.6%top 54% of all CVEs

observed exploitation

nono source reports it

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Mattermost · Mattermost

References

https://mattermost.com/security-updates