Description
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 9.6.0, 9.5.0 – ≤ 9.5.2, 9.4.0 – ≤ 9.4.4, 8.1.0 – ≤ 8.1.11 | 9.7.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | >= 8.1.0, < 8.1.12 | 8.1.12 | GHSA-8f99-g2pj-x8w3 |
| Go | github.com/mattermost/mattermost-server | >= 9.4.0, < 9.4.5 | 9.4.5 | GHSA-8f99-g2pj-x8w3 |
| Go | github.com/mattermost/mattermost-server | >= 9.5.0, < 9.5.3 | 9.5.3 | GHSA-8f99-g2pj-x8w3 |
| Go | github.com/mattermost/mattermost-server | >= 9.6.0-rc1, < 9.6.1 | 9.6.1 | GHSA-8f99-g2pj-x8w3 |
| Go | github.com/mattermost/mattermost-server | >= 8.1.0+incompatible, < 8.1.12+incompatible · >= 9.4.0+incompatible, < 9.4.5+incompatible · >= 9.5.0+incompatible, < 9.5.3+incompatible · >= 9.6.0-rc1+incompatible, < 9.6.1+incompatible | 8.1.12+incompatible, 9.4.5+incompatible, 9.5.3+incompatible, 9.6.1+incompatible | GO-2024-2795 |
Advisories 1
- WID-SEC-2024-0718 Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Apr 28, 2024