What is GHSA-826h-p4c3-477p?

GHSA-826h-p4c3-477p is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost Race Condition vulnerability

Which CVE IDs does GHSA-826h-p4c3-477p cover?

GHSA-826h-p4c3-477p covers the following CVE IDs: CVE-2024-48872. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-826h-p4c3-477p?

GHSA-826h-p4c3-477p has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

Which products are affected by GHSA-826h-p4c3-477p?

GHSA-826h-p4c3-477p affects 4 products, including: go/github.com/mattermost/mattermost/server/v8:\u003e= 10.0.0, \u003c 10.0.3; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.11.0, \u003c 9.11.5; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.5.0, \u003c 9.5.13; go/github.com/mattermost/mattermost/server/v8:\u003e= 10.1.0, \u003c 10.1.3.

GHSA-826h-p4c3-477pMediumCVSS 4.8

Mattermost Race Condition vulnerability

Vendor

GitHub Security Advisories

Published

December 16, 2024

Last Modified

December 16, 2024

🔗 CVE IDs covered (1)

CVE-2024-48872 →

📋 Description

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being blocked via simultaneously sending multiple login requests

🎯 Affected products4

go/github.com/mattermost/mattermost/server/v8:>= 10.0.0, < 10.0.3
go/github.com/mattermost/mattermost/server/v8:>= 9.11.0, < 9.11.5
go/github.com/mattermost/mattermost/server/v8:>= 9.5.0, < 9.5.13
go/github.com/mattermost/mattermost/server/v8:>= 10.1.0, < 10.1.3

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-48872
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-826h-p4c3-477p