{"id":"CVE-2024-4182","state":"PUBLISHED","title":"Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated","description":"Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.\n\n","publishedAt":"2024-04-26T08:25:37.093Z","updatedAt":"2024-08-01T20:33:52.520Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"Mattermost"},"assigner":"Mattermost","products":["Mattermost Mattermost"],"affected":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"9.6.0","status":"affected"},{"version":"9.5.0","status":"affected","lessThanOrEqual":"9.5.2","versionType":"semver"},{"version":"9.4.0","status":"affected","lessThanOrEqual":"9.4.4","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThanOrEqual":"8.1.11","versionType":"semver"},{"version":"9.7.0","status":"unaffected"},{"version":"9.6.1","status":"unaffected"},{"version":"9.5.3","status":"unaffected"},{"version":"9.4.5","status":"unaffected"},{"version":"8.1.12","status":"unaffected"}]}],"references":["https://mattermost.com/security-updates"],"weaknesses":["CWE-754"],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/4xxx/CVE-2024-4182.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-4182","state":"PUBLISHED","datePublished":"2024-04-26T08:25:37.093Z","dateUpdated":"2024-08-01T20:33:52.520Z","assignerShortName":"Mattermost","assignerOrgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateReserved":"2024-04-25T14:04:51.237Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.\n\n"}],"affected":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"9.6.0","status":"affected"},{"version":"9.5.0","status":"affected","lessThanOrEqual":"9.5.2","versionType":"semver"},{"version":"9.4.0","status":"affected","lessThanOrEqual":"9.4.4","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThanOrEqual":"8.1.11","versionType":"semver"},{"version":"9.7.0","status":"unaffected"},{"version":"9.6.1","status":"unaffected"},{"version":"9.5.3","status":"unaffected"},{"version":"9.4.5","status":"unaffected"},{"version":"8.1.12","status":"unaffected"}]}],"references":[{"url":"https://mattermost.com/security-updates"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-754","description":"CWE-754: Improper Check for Unusual or Exceptional Conditions","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mattermost","orgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateUpdated":"2024-04-26T08:25:37.093Z"},"credits":[{"lang":"en","type":"finder","value":"Juho Nurminen"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Update Mattermost Server to versions 9.7.0, 9.6.1, 9.5.3, 9.4.5, 8.1.12 or higher.</p>"}],"value":"Update Mattermost Server to versions 9.7.0, 9.6.1, 9.5.3, 9.4.5, 8.1.12 or higher.\n\n"}],"source":{"advisory":"MMSA-2023-00272","defect":["https://mattermost.atlassian.net/browse/MM-53185"],"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"mattermost","product":"mattermost","defaultStatus":"unknown","versions":[{"version":"8.1","status":"affected","lessThanOrEqual":"9.7","versionType":"custom"}],"cpes":["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-4182","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-30T14:54:08.480505Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:54:13.942Z"}},{"title":"CVE Program Container","references":[{"url":"https://mattermost.com/security-updates","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:33:52.520Z"}}]}}}