CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LCVE-2024-4182
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
- CWE
- CWE-754
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8f99-g2pj-x8w3 | Go | github.com/mattermost/mattermost-server | >=8.1.0 <8.1.12 | 8.1.12 |
| GHSA-8f99-g2pj-x8w3 | Go | github.com/mattermost/mattermost-server | >=9.4.0 <9.4.5 | 9.4.5 |
| GHSA-8f99-g2pj-x8w3 | Go | github.com/mattermost/mattermost-server | >=9.5.0 <9.5.3 | 9.5.3 |
| GHSA-8f99-g2pj-x8w3 | Go | github.com/mattermost/mattermost-server | >=9.6.0-rc1 <9.6.1 | 9.6.1 |
| GO-2024-2795 | Go | github.com/mattermost/mattermost-server | >=8.1.0+incompatible <8.1.12+incompatible >=9.4.0+incompatible <9.4.5+incompatible >=9.5.0+incompatible <9.5.3+incompatible >=9.6.0-rc1+incompatible <9.6.1+incompatible | 8.1.12+incompatible, 9.4.5+incompatible, 9.5.3+incompatible, 9.6.1+incompatible |