CVE-2024-47401: Mattermost Server vulnerable to application crash from attacker-generated large response
4.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.30992%
CWE
Published
10/29/2024
Updated
11/4/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20240926115259-20ed58906adc | 8.0.0-20240926115259-20ed58906adc |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from unconstrained GraphQL response generation in Playbooks. Key indicators include:
- CWE-770 (resource allocation without limits) suggests missing response size throttling
- The attack vector involves crafted Playbooks requests triggering large responses
- The Go module path indicates server/v8/channels/app/playbooks as the likely location
- GraphQL resolvers and error handlers are common amplification points While specific function names aren't provided in the advisory, the pattern matches:
- GraphQL resolver methods processing Playbooks data
- Error handlers generating verbose responses Confidence is medium due to lack of direct code references, but the technical description strongly suggests these components.