CVE-2024-22091: Mattermost fails to limit the size of a request path
(updated )
Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths
References
- github.com/advisories/GHSA-p2wq-4ggp-45f3
- github.com/mattermost/mattermost
- github.com/mattermost/mattermost/commit/13049d8b16b195f98246dff4812b5f64c1e5a627
- github.com/mattermost/mattermost/commit/49e7c477246e31c7a0bd85c1043599121755b260
- github.com/mattermost/mattermost/commit/54478f2ccbc6c4f110706966adfe0db2c16a566c
- github.com/mattermost/mattermost/commit/f6d320017549ec66efb5fdd4bc10b66ab36abb70
- mattermost.com/security-updates
- nvd.nist.gov/vuln/detail/CVE-2024-22091
Code Behaviors & Features
Detect and mitigate CVE-2024-22091 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →