Medium WID-SEC-2024-3494 2 CVEs

Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Nov 18, 2024 · Updated Jan 9, 2025 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 2

Medium 6.5

CVE-2024-54083

DoS via lack of type validation in Calls

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side (webapp and mobile) DoS to users of particular channels, by sending a speciall…

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

Dec 16, 2024
Medium 6.5

CVE-2024-54682

Zipbomb DoS via Missing Slack Import Validation

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin.

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

Dec 16, 2024

Revision history

2025-01-09 #2
CVE's ergänzt
2024-11-18 #1
Initiale Fassung

References

Mattermost Security Updates vom 2024-11-14
https://mattermost.com/security-updates/