~ / search / GHSA-8f99-g2pj-x8w3

GHSA-8f99-g2pj-x8w3

Mattermost crashes web clients via a malformed custom status

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-4182

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-server >= 8.1.0, < 8.1.12 8.1.12
Go github.com/mattermost/mattermost-server >= 9.4.0, < 9.4.5 9.4.5
Go github.com/mattermost/mattermost-server >= 9.5.0, < 9.5.3 9.5.3
Go github.com/mattermost/mattermost-server >= 9.6.0-rc1, < 9.6.1 9.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.

References

External links from the advisory. They lead to third-party sites.