CVE-2024-28949

—

CVSS 3.1

6.5 medium

EPSS

<1%p45

Published

Apr 5, 2024 (Apr 5, 2024)

Modified

Jun 17, 2026

Description

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

Vendors: mattermost
Products: mattermost server
Weakness: CWE-400, CWE-770
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.