What is GHSA-69pr-78gv-7c6h?

GHSA-69pr-78gv-7c6h is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost Improper Validation of Specified Type of Input vulnerability

Which CVE IDs does GHSA-69pr-78gv-7c6h cover?

GHSA-69pr-78gv-7c6h covers the following CVE IDs: CVE-2024-54083. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-69pr-78gv-7c6h?

GHSA-69pr-78gv-7c6h has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-69pr-78gv-7c6h?

GHSA-69pr-78gv-7c6h affects 4 products, including: go/github.com/mattermost/mattermost/server/v8:\u003e= 10.0.0, \u003c 10.0.3; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.11.0, \u003c 9.11.5; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.5.0, \u003c 9.5.13; go/github.com/mattermost/mattermost/server/v8:\u003e= 10.1.0, \u003c 10.1.3.

GHSA-69pr-78gv-7c6hMediumCVSS 6.5

Mattermost Improper Validation of Specified Type of Input vulnerability

Vendor

GitHub Security Advisories

Published

December 16, 2024

Last Modified

December 16, 2024

🔗 CVE IDs covered (1)

CVE-2024-54083 →

📋 Description

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side (webapp and mobile) DoS to users of particular channels, by sending a specially crafted post.

🎯 Affected products4

go/github.com/mattermost/mattermost/server/v8:>= 10.0.0, < 10.0.3
go/github.com/mattermost/mattermost/server/v8:>= 9.11.0, < 9.11.5
go/github.com/mattermost/mattermost/server/v8:>= 9.5.0, < 9.5.13
go/github.com/mattermost/mattermost/server/v8:>= 10.1.0, < 10.1.3

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-54083
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-69pr-78gv-7c6h