Vulnerability Details CVE-2024-47401
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 49.7%
CVSS Severity
CVSS v3 Score 4.3
References
Products affected by CVE-2024-47401
-
cpe:2.3:a:mattermost:mattermost_server:9.10.0
-
cpe:2.3:a:mattermost:mattermost_server:9.10.1
-
cpe:2.3:a:mattermost:mattermost_server:9.10.2
-
cpe:2.3:a:mattermost:mattermost_server:9.11.0
-
cpe:2.3:a:mattermost:mattermost_server:9.11.1
-
cpe:2.3:a:mattermost:mattermost_server:9.5.0
-
cpe:2.3:a:mattermost:mattermost_server:9.5.1
-
cpe:2.3:a:mattermost:mattermost_server:9.5.2
-
cpe:2.3:a:mattermost:mattermost_server:9.5.3
-
cpe:2.3:a:mattermost:mattermost_server:9.5.4
-
cpe:2.3:a:mattermost:mattermost_server:9.5.5
-
cpe:2.3:a:mattermost:mattermost_server:9.5.6
-
cpe:2.3:a:mattermost:mattermost_server:9.5.7
-
cpe:2.3:a:mattermost:mattermost_server:9.5.8
-
cpe:2.3:a:mattermost:mattermost_server:9.5.9