CVE-2024-48872 - Bypass of "Max failed attempts" restriction via race condition

Back Back to CVE browser

MEDIUM

Bypass of "Max failed attempts" restriction via race condition

Published Dec 16, 2024

4.8

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being blocked via simultaneously sending multiple login requests

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
- Version
  10.0.0
  Status
  affected
  Constraints
  <=10.0.2
- Version
  10.1.0
  Status
  affected
  Constraints
  <=10.1.2
- Version
  9.11.0
  Status
  affected
  Constraints
  <=9.11.4
- Version
  9.5.0
  Status
  affected
  Constraints
  <=9.5.12
- Version
  10.0.3
  Status
  unaffected
  Constraints
  -
- Version
  10.1.3
  Status
  unaffected
  Constraints
  -
- Version
  10.2.0
  Status
  unaffected
  Constraints
  -
- Version
  9.11.5
  Status
  unaffected
  Constraints
  -
- Version
  9.5.13
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mattermost

unaffected

Version	Status	Constraints
10.0.0	affected	<=10.0.2
10.1.0	affected	<=10.1.2
9.11.0	affected	<=9.11.4
9.5.0	affected	<=9.5.12
10.0.3	unaffected	-
10.1.3	unaffected	-
10.2.0	unaffected	-
9.11.5	unaffected	-
9.5.13	unaffected	-

github.com/mattermost/mattermost-server/v5

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server/v6

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server

Go

Introduced 10.1.0+incompatible Fixed 10.1.3+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 9.5.0+incompatible Fixed 9.5.13+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 9.11.0+incompatible Fixed 9.11.5+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 10.0.0+incompatible Fixed 10.0.3+incompatible
github.com/mattermost/mattermost/server/v8

Go

Introduced 0 Fixed not fixed

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost-server/v5	0	not fixed
Go	github.com/mattermost/mattermost-server/v6	0	not fixed
Go	github.com/mattermost/mattermost-server	10.1.0+incompatible	10.1.3+incompatible
Go	github.com/mattermost/mattermost-server	9.5.0+incompatible	9.5.13+incompatible
Go	github.com/mattermost/mattermost-server	9.11.0+incompatible	9.11.5+incompatible
Go	github.com/mattermost/mattermost-server	10.0.0+incompatible	10.0.3+incompatible
Go	github.com/mattermost/mattermost/server/v8	0	not fixed

Remediation

Vendor solution

Update Mattermost Server to versions 10.2.0, 10.1.3, 10.0.3, 9.11.5, 9.5.13 or higher.

Weaknesses (1)

CWE-362

Race Condition

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3530
Advisory
https://github.com/advisories/GHSA-826h-p4c3-477p
Advisory
https://mattermost.com/security-updates
Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-48872

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3530		Advisory
https://github.com/advisories/GHSA-826h-p4c3-477p		Advisory
https://mattermost.com/security-updates		Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-48872