Description
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
Published: 2024-09-26
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Update Mattermost to versions 10.0.0, 9.11.1, 9.5.9 or higher.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-2720 Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
Github GHSA Github GHSA GHSA-59hf-mpf8-pqjh Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events
References
Link Providers
https://mattermost.com/security-updates cve-icon cve-icon
History

Sun, 13 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00158}

 epss

{'score': 0.00171}

Thu, 26 Sep 2024 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Mattermost
Mattermost mattermost Server
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost_server:9.11.0:-:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc1:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc2:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc3:*:*:*:*:*:*
Vendors & Products Mattermost
Mattermost mattermost Server

Thu, 26 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Sep 2024 08:15:00 +0000

Type Values Removed Values Added
Description Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
Title DoS via non-string message using permalink embed
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Mattermost Mattermost Server
cve-icon MITRE

Status: PUBLISHED

Assigner: Mattermost

Published:

Updated: 2024-09-26T13:11:00.827Z

Reserved: 2024-09-23T07:55:36.376Z

Link: CVE-2024-47003

cve-icon Vulnrichment

Updated: 2024-09-26T13:10:56.623Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-26T08:15:06.227

Modified: 2024-09-26T18:42:29.383

Link: CVE-2024-47003

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses