Vulnerability DatabaseCVE-2024-4183

CVE-2024-4183:
vulnerability analysis and mitigation

Overview

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, and 9.4.x before 9.4.5 are affected by a vulnerability related to session management. The vulnerability was discovered and disclosed on April 26, 2024, and affects the Mattermost server software. This security issue has been assigned CVE-2024-4183 and has been given a CVSS v3.1 base score of 4.3 (Medium) (NVD, RedHat).

Technical details

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and stems from the application's failure to limit the number of active sessions. The issue is exploitable through the getSessions API endpoint. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, indicating that the vulnerability requires network access and low privileges to exploit, with no user interaction needed (RedHat).

Impact

When exploited, this vulnerability can lead to a denial of service condition by crashing the Mattermost server. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (NVD).

Exploitability

The vulnerability requires an authenticated attacker who can make repeated requests to the getSessions API. The attacker can cause a denial of service by flooding the sessions table, which eventually leads to server crashes (NVD).

Mitigation and workarounds

Users should upgrade to the fixed versions: Mattermost 8.1.12, 9.6.1, 9.5.3, or 9.4.5, depending on their current version. These releases contain patches that address the session management vulnerability (Mattermost Security).