Vulnerability Details CVE-2024-4182
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 41.6%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2024-4182
-
cpe:2.3:a:mattermost:mattermost_server:8.1.0
-
cpe:2.3:a:mattermost:mattermost_server:8.1.1
-
cpe:2.3:a:mattermost:mattermost_server:8.1.10
-
cpe:2.3:a:mattermost:mattermost_server:8.1.11
-
cpe:2.3:a:mattermost:mattermost_server:8.1.2
-
cpe:2.3:a:mattermost:mattermost_server:8.1.3
-
cpe:2.3:a:mattermost:mattermost_server:8.1.4
-
cpe:2.3:a:mattermost:mattermost_server:8.1.5
-
cpe:2.3:a:mattermost:mattermost_server:8.1.6
-
cpe:2.3:a:mattermost:mattermost_server:8.1.7
-
cpe:2.3:a:mattermost:mattermost_server:8.1.8
-
cpe:2.3:a:mattermost:mattermost_server:8.1.9
-
cpe:2.3:a:mattermost:mattermost_server:9.4.0
-
cpe:2.3:a:mattermost:mattermost_server:9.4.1
-
cpe:2.3:a:mattermost:mattermost_server:9.4.2
-
cpe:2.3:a:mattermost:mattermost_server:9.4.3
-
cpe:2.3:a:mattermost:mattermost_server:9.4.4
-
cpe:2.3:a:mattermost:mattermost_server:9.5.0
-
cpe:2.3:a:mattermost:mattermost_server:9.5.1
-
cpe:2.3:a:mattermost:mattermost_server:9.5.2
-
cpe:2.3:a:mattermost:mattermost_server:9.6.0