CVE-2024-28949: DoS via a large number of User Preferences
Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28949?
CVE-2024-28949 has been classified as a vulnerability that can lead to potential denial of service.
How do I fix CVE-2024-28949?
To fix CVE-2024-28949, upgrade to Mattermost Server version 9.5.2, 9.4.4, 9.3.3, or 8.1.11.
Which versions of Mattermost Server are affected by CVE-2024-28949?
Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, and 8.1.x before 8.1.11 are affected.
What type of attack does CVE-2024-28949 allow?
CVE-2024-28949 allows an attacker to exploit user preferences to potentially cause a denial of service.
Is there any workaround for CVE-2024-28949?
There are no documented workarounds for CVE-2024-28949; updating to a fixed version is recommended.