« Volver al listado

CVE-2024-4183

Estado: AnalizadaMedia (6.5)—

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mattermost — Mattermost Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-4183",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-4183",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-29T17:36:22.940094Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "responsibledisclosure@mattermost.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "affectedData": [
        {
          "vendor": "Mattermost",
          "product": "Mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "9.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.1.10"
            },
            {
              "status": "affected",
              "version": "9.5.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.5.2"
            },
            {
              "status": "affected",
              "version": "9.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.4.4"
            },
            {
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.1.11"
            },
            {
              "status": "unaffected",
              "version": "9.7.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.1.11"
            },
            {
              "status": "unaffected",
              "version": "9.6.1"
            },
            {
              "status": "unaffected",
              "version": "9.5.3"
            },
            {
              "status": "unaffected",
              "version": "9.4.5"
            },
            {
              "status": "unaffected",
              "version": "8.1.12"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
          ],
          "vendor": "mattermost",
          "product": "mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "9.6.0"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
          ],
          "vendor": "mattermost",
          "product": "mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "-"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
          ],
          "vendor": "mattermost",
          "product": "mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "9.4.0"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:mattermost:mattermost:-:*:*:*:*:*:*:*"
          ],
          "vendor": "mattermost",
          "product": "mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "8.1.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-26T09:15:12.717",
  "references": [
    {
      "url": "https://mattermost.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "responsibledisclosure@mattermost.com"
    },
    {
      "url": "https://mattermost.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsibledisclosure@mattermost.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.\n\n"
    },
    {
      "lang": "es",
      "value": "Las versiones de Mattermost 8.1.x anteriores a 8.1.12, 9.6.x anteriores a 9.6.1, 9.5.x anteriores a 9.5.3, 9.4.x anteriores a 9.4.5 no limitan el número de sesiones activas, lo que permite que un atacante autenticado falle el servidor a través de solicitudes repetidas a la API getSessions después de inundar la tabla de sesiones."
    }
  ],
  "lastModified": "2026-06-17T08:01:17.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78A6C1F3-95B8-4231-B5D8-C8BB65EA9BFB",
              "versionEndExcluding": "8.1.12",
              "versionStartIncluding": "8.1.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AB75A52-8C4A-44EC-AC33-B97F122FC6CA",
              "versionEndExcluding": "9.4.5",
              "versionStartIncluding": "9.4.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4846F2D-56D5-4D24-BF0D-2075072A6ADF",
              "versionEndExcluding": "9.5.3",
              "versionStartIncluding": "9.5.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4540F56-1DA0-407F-A909-335D8DF3193C",
              "versionEndExcluding": "9.6.1",
              "versionStartIncluding": "9.6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com"
}