Vulnerability · Published Mar 15, 2024 · Assigned by Mattermost
CVE-2024-28053Resource Exhaustion via the Invitation Feature
Low 3.1
In plain English
A low-severity uncontrolled resource consumption in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.5%top 56.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | 0.0.0-20240209181221-674f549daf0e | GHSA-qqc8-rv37-79q5 |
| Go | github.com/mattermost/mattermost-server | 0.0.0-20240209181221-674f549daf0e | GO-2024-3334 |
| Go | github.com/mattermost/mattermost-server/v5 | 0.0.0-20240209181221-674f549daf0e | GHSA-qqc8-rv37-79q5 |
| Go | github.com/mattermost/mattermost-server/v5 | no fix listed | GO-2024-3334 |
| Go | github.com/mattermost/mattermost-server/v6 | 0.0.0-20240209181221-674f549daf0e | GHSA-qqc8-rv37-79q5 |
| Go | github.com/mattermost/mattermost-server/v6 | no fix listed | GO-2024-3334 |
| Go | github.com/mattermost/mattermost/server/v8 | 0.0.0-20240209181221-674f549daf0e | GHSA-qqc8-rv37-79q5 |
| Go | github.com/mattermost/mattermost/server/v8 | no fix listed | GO-2024-3334 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 8.1.0 – through 8.1.9 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L