{"id":"CVE-2024-4183","published":"2024-04-26T08:25:47Z","modified":"2024-08-01T20:33:52Z","title":"Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the…","vendor":"Mattermost","product":"Mattermost","tier":"tail","description":{"text":"Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.\n\n","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00611,"percentile":0.49197,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://mattermost.com/security-updates","tags":[]}],"priority":{"score":12.8,"factors":[{"name":"EPSS percentile","points":9.84},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"mattermost","affectedVersions":[{"vendor":"Mattermost","product":"Mattermost","versions":[">= 9.6.0, <= 8.1.10",">= 9.5.0, <= 9.5.2",">= 9.4.0, <= 9.4.4",">= 8.1.0, <= 8.1.11"]}],"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":[">=9.6.0-rc1, <9.6.1",">=9.5.0, <9.5.3",">=9.4.0, <9.4.5",">=8.1.0, <8.1.12",">=8.1.0+incompatible, <8.1.12+incompatible",">=9.4.0+incompatible, <9.4.5+incompatible",">=9.5.0+incompatible, <9.5.3+incompatible",">=9.6.0-rc1+incompatible, <9.6.1+incompatible"],"patched":["9.6.1","9.5.3","9.4.5","8.1.12","8.1.12+incompatible","9.4.5+incompatible","9.5.3+incompatible","9.6.1+incompatible"],"from":["GHSA-wj37-mpq9-xrcm","GO-2024-2798"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1321","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mattermost-cve-2023-50333","parents":[{"from":"CVE-2023-50333","to":"CVE-2024-4183","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/channels/app/platform/session.go"],"commits":["https://github.com/mattermost/mattermost/commit/61dd452fb2fcd3ac6f7b2e050f7f0a93a92d95fc","https://github.com/mattermost/mattermost/commit/86920d641760552c5aafa5e1d14c93bd30039bc4","https://github.com/mattermost/mattermost/commit/9d81eee979aee93374bff8ba6714d805e12ffb03"],"basis":"rarely changed file"}]},{"from":"CVE-2024-1402","to":"CVE-2024-4183","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/channels/store/opentracinglayer/opentracinglayer.go","server/channels/store/retrylayer/retrylayer.go","server/channels/store/store.go","server/channels/store/timerlayer/timerlayer.go"],"commits":["https://github.com/mattermost/mattermost/commit/64cb0ca8af2dbda1afcddd1604460591a4799b81","https://github.com/mattermost/mattermost/commit/6d2440de9fd774b67e65e3aac4ab8b6ef9aba2d8","https://github.com/mattermost/mattermost/commit/86920d641760552c5aafa5e1d14c93bd30039bc4","https://github.com/mattermost/mattermost/commit/9d81eee979aee93374bff8ba6714d805e12ffb03"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2024-2447","published":"2024-04-05","fixed":"9.5.2+incompatible","kev":false,"link":{"from":"CVE-2024-2447","to":"CVE-2024-4183","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"9.4.4+incompatible","toFixed":"9.4.5","daysApart":21}]}},{"cve":"CVE-2024-22091","published":"2024-04-26","fixed":"9.6.1+incompatible","kev":false},{"cve":"CVE-2024-32046","published":"2024-04-26","fixed":"9.6.1+incompatible","kev":false},{"cve":"CVE-2024-4182","published":"2024-04-26","fixed":"9.6.1+incompatible","kev":false},{"cve":"CVE-2024-4183","published":"2024-04-26","fixed":"9.6.1+incompatible","kev":false},{"cve":"CVE-2024-4198","published":"2024-04-26","fixed":"9.6.1+incompatible","kev":false},{"cve":"CVE-2024-29977","published":"2024-08-01","fixed":"9.9.1+incompatible","kev":false},{"cve":"CVE-2024-36492","published":"2024-08-01","fixed":"9.9.1+incompatible","kev":false}],"package":"Go:github.com/mattermost/mattermost-server"}}