CVE-2024-47401

Description

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks.

Reserved 2024-10-21 | Published 2024-10-29 | Updated 2024-10-29 | Assigner Mattermost

Problem types

CWE-770: Allocation of Resources Without Limits or Throttling

Product status

Default status
unaffected

9.10.0
affected

9.11.0
affected

9.5.0
affected

10.0.0
unaffected

9.10.3
unaffected

9.11.2
unaffected

9.5.10
unaffected

Credits

DoyenSec finder

References

mattermost.com/security-updates

cve.org (CVE-2024-47401)

nvd.nist.gov (CVE-2024-47401)

Download JSON