{"id":"CVE-2024-4183","state":"PUBLISHED","title":"Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attac","description":"Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.\n\n","publishedAt":"2024-04-26T08:25:47.088Z","updatedAt":"2024-08-01T20:33:52.871Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"Mattermost"},"assigner":"Mattermost","products":["Mattermost Mattermost"],"affected":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"9.6.0","status":"affected","lessThanOrEqual":"8.1.10","versionType":"semver"},{"version":"9.5.0","status":"affected","lessThanOrEqual":"9.5.2","versionType":"semver"},{"version":"9.4.0","status":"affected","lessThanOrEqual":"9.4.4","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThanOrEqual":"8.1.11","versionType":"semver"},{"version":"9.7.0","status":"unaffected","lessThanOrEqual":"8.1.11","versionType":"semver"},{"version":"9.6.1","status":"unaffected"},{"version":"9.5.3","status":"unaffected"},{"version":"9.4.5","status":"unaffected"},{"version":"8.1.12","status":"unaffected"}]}],"references":["https://mattermost.com/security-updates"],"weaknesses":["CWE-400"],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/4xxx/CVE-2024-4183.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-4183","state":"PUBLISHED","datePublished":"2024-04-26T08:25:47.088Z","dateUpdated":"2024-08-01T20:33:52.871Z","assignerShortName":"Mattermost","assignerOrgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateReserved":"2024-04-25T14:18:54.310Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.\n\n"}],"affected":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"9.6.0","status":"affected","lessThanOrEqual":"8.1.10","versionType":"semver"},{"version":"9.5.0","status":"affected","lessThanOrEqual":"9.5.2","versionType":"semver"},{"version":"9.4.0","status":"affected","lessThanOrEqual":"9.4.4","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThanOrEqual":"8.1.11","versionType":"semver"},{"version":"9.7.0","status":"unaffected","lessThanOrEqual":"8.1.11","versionType":"semver"},{"version":"9.6.1","status":"unaffected"},{"version":"9.5.3","status":"unaffected"},{"version":"9.4.5","status":"unaffected"},{"version":"8.1.12","status":"unaffected"}]}],"references":[{"url":"https://mattermost.com/security-updates"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mattermost","orgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateUpdated":"2024-04-26T08:25:47.088Z"},"credits":[{"lang":"en","type":"finder","value":"vultza (vultza)"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Update Mattermost Server to versions 9.7.0, 9.6.1, 9.5.3, 9.4.5, 8.1.12 or higher.</p>"}],"value":"Update Mattermost Server to versions 9.7.0, 9.6.1, 9.5.3, 9.4.5, 8.1.12 or higher.\n\n"}],"source":{"advisory":"MMSA-2023-00279","defect":["https://mattermost.atlassian.net/browse/MM-55319"],"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"mattermost","product":"mattermost","defaultStatus":"unknown","versions":[{"version":"9.6.0","status":"affected"}],"cpes":["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"]},{"vendor":"mattermost","product":"mattermost","defaultStatus":"unknown","versions":[{"version":"-","status":"affected"}],"cpes":["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"]},{"vendor":"mattermost","product":"mattermost","defaultStatus":"unknown","versions":[{"version":"9.4.0","status":"affected"}],"cpes":["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"]},{"vendor":"mattermost","product":"mattermost","defaultStatus":"unknown","versions":[{"version":"8.1.0","status":"affected"}],"cpes":["cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-4183","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-29T17:36:22.940094Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:54:30.447Z"}},{"title":"CVE Program Container","references":[{"url":"https://mattermost.com/security-updates","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:33:52.871Z"}}]}}}