CVE-2024-48872
Bypass of "Max failed attempts" restriction via race condition
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Bypass of "Max failed attempts" restriction via race condition
Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being blocked via simultaneously sending multiple login requests
Reserved 2024-12-11 | Published 2024-12-16 | Updated 2024-12-16 | Assigner MattermostCWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Roman Shchekin (qtros)
mattermost.com/security-updates
Support options
