CVE-2024-1402

Description

Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post.

How to fix CVE-2024-1402

To remediate CVE-2024-1402, upgrade the affected package to a fixed version below.

• —upgrade to 9.6.1 or later
• —upgrade to 9.1.5+incompatible or later
• —no fix listed
• —no fix listed
• —upgrade to 8.1.8 or later
• —no fix listed

Is CVE-2024-1402 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• from 0, < 9.6.1
• >= 9.1.0+incompatible, < 9.1.5+incompatible, >= 9.2.0+incompatible, < 9.2.4+incompatible
• from 0
• from 0
• from 0, < 8.1.8
• from 0

CVSS scores

References (7)

• ADVISORYgithub.com/advisories/GHSA-32h7-7j94-8fc2
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-1402
• PATCHgithub.com/mattermost/mattermost
• WEBgithub.com/mattermost/mattermost/commit/64cb0ca8af2dbda1afcddd1604460591a4799b81