{"id":"CVE-2024-1402","published":"2024-02-09T15:09:18Z","modified":"2024-08-01T18:40:20Z","title":"Denial of service in mattermost mobile apps and server via emoji reactions","vendor":"Mattermost","product":"Mattermost","tier":"tail","description":{"text":"Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post. \n\n","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00524,"percentile":0.44446,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://mattermost.com/security-updates","tags":[]}],"priority":{"score":11.9,"factors":[{"name":"EPSS percentile","points":8.89},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"mattermost","affectedVersions":[{"vendor":"Mattermost","product":"Mattermost","versions":["<= 8.1.7","<= 9.1.4","<= 9.2.3"]}],"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","vulnerableRanges":["<8.1.8",">=9.2.0, <9.2.4",">=9.1.0, <9.1.5","all versions"],"patched":["8.1.8","9.2.4","9.1.5"],"from":["GHSA-32h7-7j94-8fc2","GO-2024-2541"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":[">=9.1.0+incompatible, <9.1.5+incompatible",">=9.2.0+incompatible, <9.2.4+incompatible"],"patched":["9.1.5+incompatible","9.2.4+incompatible"],"from":["GO-2024-2541"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v5","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2541"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v6","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2541"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0474","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mattermost-cve-2023-50333","children":[{"from":"CVE-2024-1402","to":"CVE-2024-4183","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/channels/store/opentracinglayer/opentracinglayer.go","server/channels/store/retrylayer/retrylayer.go","server/channels/store/store.go","server/channels/store/timerlayer/timerlayer.go"],"commits":["https://github.com/mattermost/mattermost/commit/64cb0ca8af2dbda1afcddd1604460591a4799b81","https://github.com/mattermost/mattermost/commit/6d2440de9fd774b67e65e3aac4ab8b6ef9aba2d8","https://github.com/mattermost/mattermost/commit/86920d641760552c5aafa5e1d14c93bd30039bc4","https://github.com/mattermost/mattermost/commit/9d81eee979aee93374bff8ba6714d805e12ffb03"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-48732","published":"2024-01-02","fixed":"8.1.7","kev":false,"link":{"from":"CVE-2023-48732","to":"CVE-2024-1402","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost/server/v8","fromFixed":"8.1.7","toFixed":"8.1.8","daysApart":38}]}},{"cve":"CVE-2023-48268","published":"2023-11-27","fixed":"9.1.1","kev":false},{"cve":"CVE-2023-48369","published":"2023-11-27","fixed":"9.1.1","kev":false},{"cve":"CVE-2023-6202","published":"2023-11-27","fixed":"9.1.1","kev":false},{"cve":"CVE-2024-1402","published":"2024-02-09","fixed":"9.2.4","kev":false},{"cve":"CVE-2024-24776","published":"2024-02-09","fixed":"9.3.0","kev":false},{"cve":"CVE-2024-1887","published":"2024-02-29","fixed":"9.3.1","kev":false},{"cve":"CVE-2024-1942","published":"2024-02-29","fixed":"9.3.1","kev":false}],"package":"Go:github.com/mattermost/mattermost/server/v8"}}