CVE-2024-4182

MEDIUM

Mattermost 8.1.0-8.1.11, 9.4.0-9.4.4, 9.5.0-9.5.2 - Authenticated Denial of Service via Malformed Custom Status JSON

Title source: llm

Description

Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.

References (1)

Core 1

Core References

Vendor Advisory

https://mattermost.com/security-updates

Scores

CVSS v3 4.3

EPSS 0.0019

EPSS Percentile 41.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-754

Status published

Products (2)

mattermost/mattermost-server 8.1.0 - 8.1.12Go

mattermost/mattermost_server 8.1.0 - 8.1.12

Published Apr 26, 2024

Tracked Since Feb 18, 2026