CVE-2024-2446: Medium severity mattermost vulnerability

Q: What is the severity of CVE-2024-2446?

CVE-2024-2446 has a severity rating that indicates it is a denial of service vulnerability that can impact user experience by crashing client applications.

Q: How do I fix CVE-2024-2446?

To fix CVE-2024-2446, upgrade Mattermost Server to versions 8.1.10, 9.2.6, 9.3.2, or 9.4.3 or later.

Q: Who is affected by CVE-2024-2446?

CVE-2024-2446 affects Mattermost Server versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3.

Q: What type of attack does CVE-2024-2446 enable?

CVE-2024-2446 enables an authenticated attacker to send crafted messages that can crash the client applications of other users.

Q: Is there a workaround for CVE-2024-2446?

There are no specific workarounds for CVE-2024-2446; the best mitigation is to apply the recommended software updates.

Published Mar 15, 2024

Updated

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages.

Affected Software

4 affected components

Mattermost Mattermost Server>=8.1.0<8.1.10

Mattermost Mattermost Server>=9.2.0<9.2.6

Mattermost Mattermost Server>=9.3.0<9.3.2

Mattermost Mattermost Server>=9.4.0<9.4.3

Remediation

Information

Update Mattermost Server to versions 9.5, 9.4.3, 9.3.2, 9.2.6, 8.1.10 or higher.

Event History

Mar 15, 2024

CVE Published

via MITRE·09:11 AM

Data Sourced

via MITRE·09:11 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-2446?

CVE-2024-2446 has a severity rating that indicates it is a denial of service vulnerability that can impact user experience by crashing client applications.

How do I fix CVE-2024-2446?