Vulnerability DatabaseCVE-2024-24988

CVE-2024-24988:
vulnerability analysis and mitigation

Overview

Mattermost server contains a vulnerability (CVE-2024-24988) where it fails to properly validate the length of the emoji value in the custom user status. This vulnerability affects Mattermost server versions 8.1.x before 8.1.8, 9.0.0 through 9.1.5, and 9.2.0 through 9.2.4. The vulnerability was discovered and disclosed on February 29, 2024 (NVD).

Technical details

The vulnerability is characterized by improper validation of emoji value length in custom user status. The CVSS v3.1 base score is 6.5 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H as assessed by NIST. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) (NVD).

Impact

When exploited, this vulnerability can lead to high resource consumption and potentially crash the server due to the ability to send multiple very long strings as emoji values (NVD).

Exploitability

The vulnerability requires low attack complexity and low privileges to exploit. The attack vector is network-accessible, and no user interaction is required for exploitation (NVD).

Mitigation and workarounds

Users should upgrade to the latest version of Mattermost server that contains the fix for this vulnerability. The fixed versions are 8.1.8, 9.1.5, or 9.2.4 and later (NVD).