mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
157 lines
6.5 KiB
JSON
157 lines
6.5 KiB
JSON
{
|
|
"data_version": "4.0",
|
|
"data_type": "CVE",
|
|
"data_format": "MITRE",
|
|
"CVE_data_meta": {
|
|
"ID": "CVE-2024-1953",
|
|
"ASSIGNER": "responsibledisclosure@mattermost.com",
|
|
"STATE": "PUBLIC"
|
|
},
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.\n\n"
|
|
}
|
|
]
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "CWE-400: Uncontrolled Resource Consumption",
|
|
"cweId": "CWE-400"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"vendor_name": "Mattermost",
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "Mattermost",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"lessThanOrEqual": "9.4.1",
|
|
"status": "affected",
|
|
"version": "9.4.0",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"status": "affected",
|
|
"version": "9.3.0"
|
|
},
|
|
{
|
|
"lessThanOrEqual": "9.2.4",
|
|
"status": "affected",
|
|
"version": "9.2.0",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"lessThanOrEqual": "8.1.8",
|
|
"status": "affected",
|
|
"version": "8.1.0",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"status": "unaffected",
|
|
"version": "9.5"
|
|
},
|
|
{
|
|
"status": "unaffected",
|
|
"version": "9.4.2"
|
|
},
|
|
{
|
|
"status": "unaffected",
|
|
"version": "9.3.1"
|
|
},
|
|
{
|
|
"status": "unaffected",
|
|
"version": "9.2.5"
|
|
},
|
|
{
|
|
"status": "unaffected",
|
|
"version": "8.1.9"
|
|
}
|
|
],
|
|
"defaultStatus": "unaffected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"url": "https://mattermost.com/security-updates",
|
|
"refsource": "MISC",
|
|
"name": "https://mattermost.com/security-updates"
|
|
}
|
|
]
|
|
},
|
|
"generator": {
|
|
"engine": "Vulnogram 0.1.0-dev"
|
|
},
|
|
"source": {
|
|
"advisory": "MMSA-2023-00273",
|
|
"defect": [
|
|
"https://mattermost.atlassian.net/browse/MM-55093"
|
|
],
|
|
"discovery": "EXTERNAL"
|
|
},
|
|
"solution": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "<p>Update Mattermost Server to versions 9.5, 9.4.2, 9.3.1, 9.2.5, 8.1.9, or higher.</p>"
|
|
}
|
|
],
|
|
"value": "Update Mattermost Server to versions 9.5, 9.4.2, 9.3.1, 9.2.5, 8.1.9, or higher.\n\n"
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"value": "vultza"
|
|
}
|
|
],
|
|
"impact": {
|
|
"cvss": [
|
|
{
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "LOW",
|
|
"baseScore": 4.3,
|
|
"baseSeverity": "MEDIUM",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "NONE",
|
|
"privilegesRequired": "LOW",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
|
|
"version": "3.1"
|
|
}
|
|
]
|
|
}
|
|
} |