CVE-2024-4183: Medium severity Mattermost Mattermost Server vulnerability

Q: What is the severity of CVE-2024-4183?

CVE-2024-4183 is considered a high severity vulnerability due to its potential to crash the Mattermost server.

Q: How do I fix CVE-2024-4183?

To mitigate CVE-2024-4183, upgrade Mattermost to version 8.1.12, 9.4.5, 9.5.3, or 9.6.1 or later.

Q: What is the impact of CVE-2024-4183?

CVE-2024-4183 allows an authenticated attacker to crash the Mattermost server by flooding the sessions table.

Q: Is an authenticated user necessary to exploit CVE-2024-4183?

Yes, CVE-2024-4183 requires an authenticated user to exploit the vulnerability through repeated requests.

Published Apr 26, 2024

Updated

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.

Affected Software

8 affected componentsFixes available

Mattermost Mattermost Server>=8.1.0<8.1.12

Mattermost Mattermost Server>=9.4.0<9.4.5

Mattermost Mattermost Server>=9.5.0<9.5.3

Mattermost Mattermost Server>=9.6.0<9.6.1

go/github.com/mattermost/mattermost-server>=8.1.0<=8.1.11

8.1.12

go/github.com/mattermost/mattermost-server>=9.4.0<=9.4.4

9.4.5

go/github.com/mattermost/mattermost-server>=9.5.0<=9.5.2

9.5.3

go/github.com/mattermost/mattermost-server>=9.6.0-rc1<=9.6.0

9.6.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/mattermost/mattermost-server to a version that resolves this vulnerability.
Fixed in 8.1.12
Upgrade
Upgrade go/github.com/mattermost/mattermost-server to a version that resolves this vulnerability.
Fixed in 9.4.5
Upgrade
Upgrade go/github.com/mattermost/mattermost-server to a version that resolves this vulnerability.
Fixed in 9.5.3
Upgrade
Upgrade go/github.com/mattermost/mattermost-server to a version that resolves this vulnerability.
Fixed in 9.6.1
Upgrade
Upgrade Mattermost Server to a version that resolves this vulnerability.
Fixed in 9.7.0
Upgrade
Upgrade Mattermost Server to a version that resolves this vulnerability.
Fixed in 9.6.1
Upgrade
Upgrade Mattermost Server to a version that resolves this vulnerability.
Fixed in 9.5.3
Upgrade
Upgrade Mattermost Server to a version that resolves this vulnerability.
Fixed in 9.4.5
Upgrade
Upgrade Mattermost Server to a version that resolves this vulnerability.
Fixed in 8.1.12

Event History

Apr 26, 2024

CVE Published

via MITRE·08:25 AM

Data Sourced

via MITRE·08:25 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:15 AM

DescriptionSeverityWeaknessAffected Software

Advisory Published

via GitHub·09:30 AM

Frequently Asked Questions

What is the severity of CVE-2024-4183?

CVE-2024-4183 is considered a high severity vulnerability due to its potential to crash the Mattermost server.

How do I fix CVE-2024-4183?

To mitigate CVE-2024-4183, upgrade Mattermost to version 8.1.12, 9.4.5, 9.5.3, or 9.6.1 or later.

What is the impact of CVE-2024-4183?

CVE-2024-4183 allows an authenticated attacker to crash the Mattermost server by flooding the sessions table.

Which versions of Mattermost are affected by CVE-2024-4183?

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, and 9.4.x before 9.4.5 are affected by CVE-2024-4183.

Is an authenticated user necessary to exploit CVE-2024-4183?