Vulnerability · Published Feb 9, 2024 · Assigned by Mattermost
CVE-2024-1402Denial of service in mattermost mobile apps and server via emoji reactions
Medium 4.3
In plain English
A medium-severity uncontrolled resource consumption in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | 9.1.5+incompatible, 9.2.4+incompatible | GO-2024-2541 |
| Go | github.com/mattermost/mattermost-server/v5 | no fix listed | GO-2024-2541 |
| Go | github.com/mattermost/mattermost-server/v6 | no fix listed | GO-2024-2541 |
| Go | github.com/mattermost/mattermost/server/v8 | 9.2.4 | GHSA-32h7-7j94-8fc2 |
| Go | github.com/mattermost/mattermost/server/v8 | 9.1.5 | GHSA-32h7-7j94-8fc2 |
| Go | github.com/mattermost/mattermost/server/v8 | 8.1.8 | GHSA-32h7-7j94-8fc2 |
| Go | github.com/mattermost/mattermost/server/v8 | no fix listed | GO-2024-2541 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 0 – through 8.1.70 – through 9.1.40 – through 9.2.3 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L