CVE-2024-28949: DoS via a large number of User Preferences

Q: What is the severity of CVE-2024-28949?

CVE-2024-28949 has been classified as a vulnerability that can lead to potential denial of service.

Q: How do I fix CVE-2024-28949?

To fix CVE-2024-28949, upgrade to Mattermost Server version 9.5.2, 9.4.4, 9.3.3, or 8.1.11.

Q: What type of attack does CVE-2024-28949 allow?

CVE-2024-28949 allows an attacker to exploit user preferences to potentially cause a denial of service.

Q: Is there any workaround for CVE-2024-28949?

There are no documented workarounds for CVE-2024-28949; updating to a fixed version is recommended.

Published Apr 5, 2024

Updated

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

Affected Software

8 affected componentsFixes available

go/github.com/mattermost/mattermost/server/v8>=9.5.0<9.5.2

9.5.2

go/github.com/mattermost/mattermost/server/v8>=9.4.0<9.4.4

9.4.4

go/github.com/mattermost/mattermost/server/v8>=9.3.0<9.3.3

9.3.3

go/github.com/mattermost/mattermost/server/v8>=8.1.0<8.1.11

8.1.11

Mattermost Mattermost Server>=8.1.0<8.1.11

Mattermost Mattermost Server>=9.3.0<9.3.3

Mattermost Mattermost Server>=9.4.0<9.4.4

Mattermost Mattermost Server>=9.5.0<9.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/mattermost/mattermost/server/v8 to a version that resolves this vulnerability.
Fixed in 9.5.2
Upgrade
Upgrade go/github.com/mattermost/mattermost/server/v8 to a version that resolves this vulnerability.
Fixed in 9.4.4
Upgrade
Upgrade go/github.com/mattermost/mattermost/server/v8 to a version that resolves this vulnerability.
Fixed in 9.3.3
Upgrade
Upgrade go/github.com/mattermost/mattermost/server/v8 to a version that resolves this vulnerability.
Fixed in 8.1.11
Upgrade
Upgrade Mattermost Server to a version that resolves this vulnerability.
Fixed in 9.6.0
Upgrade
Upgrade Mattermost Server to a version that resolves this vulnerability.
Fixed in 9.5.2
Upgrade
Upgrade Mattermost Server to a version that resolves this vulnerability.
Fixed in 9.4.4
Upgrade
Upgrade Mattermost Server to a version that resolves this vulnerability.
Fixed in 9.3.3
Upgrade
Upgrade Mattermost Server to a version that resolves this vulnerability.
Fixed in 8.1.11

Event History

Apr 5, 2024

CVE Published

via MITRE·08:14 AM

Data Sourced

via MITRE·08:14 AM

RemedyDescriptionSeverityWeakness

Advisory Published

via GitHub·09:30 AM

Mar 29, 56939

Event

via NVD·11:10 PM

Frequently Asked Questions

What is the severity of CVE-2024-28949?

CVE-2024-28949 has been classified as a vulnerability that can lead to potential denial of service.

How do I fix CVE-2024-28949?

To fix CVE-2024-28949, upgrade to Mattermost Server version 9.5.2, 9.4.4, 9.3.3, or 8.1.11.

Which versions of Mattermost Server are affected by CVE-2024-28949?

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, and 8.1.x before 8.1.11 are affected.

What type of attack does CVE-2024-28949 allow?