CVE-2024-24988
Last modified
CVE-2024-24988 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server. . EPSS estimates a 0.68% chance of exploitation in the next 30 days.
Description
Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost Server | < 8.1.8 |
| Mattermost | Mattermost Server | >= 9.0.0, < 9.1.5 |
| Mattermost | Mattermost Server | >= 9.2.0, < 9.2.4 |
References
- https://mattermost.com/security-updatesVendor Advisory
- https://mattermost.com/security-updatesVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-24988?
How severe is CVE-2024-24988?
How do I fix CVE-2024-24988?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-24980Protection mechanism failure in some 3rd, 4th, and 5th Gener…6.9
- CVE-2024-24981Improper input validation in PfrSmiUpdateFw driver in UEFI f…7.5
- CVE-2024-24983Protection mechanism failure in firmware for some Intel(R) E…7
- CVE-2024-24984Improper input validation for some Intel(R) Wireless Bluetoo…6.8
- CVE-2024-24985Exposure of resource to wrong sphere in some Intel(R) proces…8.5
- CVE-2024-24986Improper access control in Linux kernel mode driver for some…8.8
- CVE-2024-24989When NGINX Plus or NGINX OSS are configured to use the HTTP/…7.5
- CVE-2024-2499The Squelch Tabs and Accordions Shortcodes plugin for WordPr…6.4
- CVE-2024-24990When NGINX Plus or NGINX OSS are configured to use the HTTP/…7.5
- CVE-2024-24991A Null Pointer Dereference vulnerability in WLAvalancheServi…6.5
- CVE-2024-24992A Path Traversal vulnerability in web component of Ivanti Av…8.8
- CVE-2024-24993A Race Condition (TOCTOU) vulnerability in web component of …7.5
Are you affected by CVE-2024-24988?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST