CVE-2024-28949

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 9.5.0, <= 9.5.1; >= 9.4.0, <= 9.4.3; >= 9.3.0, <= 9.3.2; >= 8.1.0, <= 8.1.10

References

https://mattermost.com/security-updatesVendor Advisory
https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Apr 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-28958.8A vulnerability was found in Tenda AC7 15.03.06.44. It has been declared as critical. This vulnerability affects the function formWifiWpsOOB CVE-2024-289506.7Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software for Windows before version 2024.2 may allow an authenticated CVE-2024-289517.8in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free.CVE-2024-289526.7Uncontrolled search path for some Intel(R) IPP software for Windows before version 2021.12.0 may allow an authenticated user to potentially CVE-2024-289536.7Uncontrolled search path in some EMON software before version 11.44 may allow an authenticated user to potentially enable escalation of priv CVE-2024-289546.7Incorrect default permissions for some Intel(R) Graphics Driver installers may allow an authenticated user to potentially enable escalation CVE-2024-289555.9Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine t CVE-2024-289565.6Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow CVE-2024-289575.3Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. If this vulnerability is exploited, a remote u CVE-2024-28968.8A vulnerability was found in Tenda AC7 15.03.06.44. It has been rated as critical. This issue affects the function formWifiWpsStart of the f CVE-2024-289608.2An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles CVE-2024-289617.8Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged mali