{"id":"CVE-2024-1953","state":"PUBLISHED","title":"Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated a","description":"Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.\n\n","publishedAt":"2024-02-29T10:42:41.576Z","updatedAt":"2024-08-16T20:58:25.047Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"Mattermost"},"assigner":"Mattermost","products":["Mattermost Mattermost"],"affected":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"9.4.0","status":"affected","lessThanOrEqual":"9.4.1","versionType":"semver"},{"version":"9.3.0","status":"affected"},{"version":"9.2.0","status":"affected","lessThanOrEqual":"9.2.4","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThanOrEqual":"8.1.8","versionType":"semver"},{"version":"9.5","status":"unaffected"},{"version":"9.4.2","status":"unaffected"},{"version":"9.3.1","status":"unaffected"},{"version":"9.2.5","status":"unaffected"},{"version":"8.1.9","status":"unaffected"}]}],"references":["https://mattermost.com/security-updates"],"weaknesses":["CWE-400"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1953.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1953","state":"PUBLISHED","datePublished":"2024-02-29T10:42:41.576Z","dateUpdated":"2024-08-16T20:58:25.047Z","assignerShortName":"Mattermost","assignerOrgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateReserved":"2024-02-27T19:37:27.574Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.\n\n"}],"affected":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"9.4.0","status":"affected","lessThanOrEqual":"9.4.1","versionType":"semver"},{"version":"9.3.0","status":"affected"},{"version":"9.2.0","status":"affected","lessThanOrEqual":"9.2.4","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThanOrEqual":"8.1.8","versionType":"semver"},{"version":"9.5","status":"unaffected"},{"version":"9.4.2","status":"unaffected"},{"version":"9.3.1","status":"unaffected"},{"version":"9.2.5","status":"unaffected"},{"version":"8.1.9","status":"unaffected"}]}],"references":[{"url":"https://mattermost.com/security-updates"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mattermost","orgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateUpdated":"2024-02-29T10:42:41.576Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"vultza"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Update Mattermost Server to versions 9.5, 9.4.2, 9.3.1, 9.2.5, 8.1.9, or higher.</p>"}],"value":"Update Mattermost Server to versions 9.5, 9.4.2, 9.3.1, 9.2.5, 8.1.9, or higher.\n\n"}],"source":{"advisory":"MMSA-2023-00273","defect":["https://mattermost.atlassian.net/browse/MM-55093"],"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://mattermost.com/security-updates","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:56:22.642Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-16T20:58:10.089758Z","id":"CVE-2024-1953","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-16T20:58:25.047Z"}}]}}}