CVE-2024-4183CWE-400

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows…

Medium · published April 26, 2024

CVSS v3.1
4.3
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.3th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-04-26T08:25Z
EPSS history
Timeline
  • 26 APR 08:25Z
    Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows…
    cvelistv5