« Volver al listado

CVE-2024-4182

Estado: AnalizadaMedia (4.3)—

Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mattermost — Mattermost Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-4182",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-4182",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-30T14:54:08.480505Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "responsibledisclosure@mattermost.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "affectedData": [
        {
          "vendor": "Mattermost",
          "product": "Mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "9.6.0"
            },
            {
              "status": "affected",
              "version": "9.5.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.5.2"
            },
            {
              "status": "affected",
              "version": "9.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.4.4"
            },
            {
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.1.11"
            },
            {
              "status": "unaffected",
              "version": "9.7.0"
            },
            {
              "status": "unaffected",
              "version": "9.6.1"
            },
            {
              "status": "unaffected",
              "version": "9.5.3"
            },
            {
              "status": "unaffected",
              "version": "9.4.5"
            },
            {
              "status": "unaffected",
              "version": "8.1.12"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
          ],
          "vendor": "mattermost",
          "product": "mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "8.1",
              "versionType": "custom",
              "lessThanOrEqual": "9.7"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-26T09:15:12.523",
  "references": [
    {
      "url": "https://mattermost.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "responsibledisclosure@mattermost.com"
    },
    {
      "url": "https://mattermost.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsibledisclosure@mattermost.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.\n\n"
    },
    {
      "lang": "es",
      "value": "Las versiones Mattermost 9.6.0, 9.5.x anteriores a 9.5.3, 9.4.x anteriores a 9.4.5 y 8.1.x anteriores a 8.1.12 no pueden manejar errores de análisis JSON en valores de estado personalizados, lo que permite que un atacante autenticado se bloquee. clientes web de otros usuarios a través de un estado personalizado con formato incorrecto."
    }
  ],
  "lastModified": "2026-06-17T08:01:17.083",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78A6C1F3-95B8-4231-B5D8-C8BB65EA9BFB",
              "versionEndExcluding": "8.1.12",
              "versionStartIncluding": "8.1.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AB75A52-8C4A-44EC-AC33-B97F122FC6CA",
              "versionEndExcluding": "9.4.5",
              "versionStartIncluding": "9.4.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4846F2D-56D5-4D24-BF0D-2075072A6ADF",
              "versionEndExcluding": "9.5.3",
              "versionStartIncluding": "9.5.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4540F56-1DA0-407F-A909-335D8DF3193C",
              "versionEndExcluding": "9.6.1",
              "versionStartIncluding": "9.6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com"
}