CVE-2024-48872

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being blocked via simultaneously sending multiple login requests

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

History

15 Oct 2025, 14:13

Type	Values Removed	Values Added
Summary		(es) Las versiones 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4 y 9.5.x <= 9.5.12 de Mattermost no pueden evitar la verificación y actualización simultánea de los intentos de inicio de sesión fallidos, lo que permite a un atacante eludir la restricción "Máximo de intentos fallidos" y enviar una gran cantidad de intentos de inicio de sesión antes de ser bloqueado mediante el envío simultáneo de múltiples solicitudes de inicio de sesión.
First Time		Mattermost mattermost Server Mattermost
CPE		cpe:2.3:a:mattermost:mattermost_server::::::::
References	~~() https://mattermost.com/security-updates -~~	() https://mattermost.com/security-updates - Vendor Advisory

16 Dec 2024, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-16 08:15

Updated : 2025-10-15 14:13

NVD link : CVE-2024-48872

Mitre link : CVE-2024-48872

CVE.ORG link : CVE-2024-48872

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2024-48872", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "published": "2024-12-16T08:15:04.950", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent\u00a0concurrently checking and updating the failed login attempts. which allows an attacker to bypass of \"Max failed attempts\" restriction and send a big number of login attempts before being blocked via simultaneously sending multiple login requests"}, {"lang": "es", "value": "Las versiones 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4 y 9.5.x <= 9.5.12 de Mattermost no pueden evitar la verificaci\u00f3n y actualizaci\u00f3n simult\u00e1nea de los intentos de inicio de sesi\u00f3n fallidos, lo que permite a un atacante eludir la restricci\u00f3n \"M\u00e1ximo de intentos fallidos\" y enviar una gran cantidad de intentos de inicio de sesi\u00f3n antes de ser bloqueado mediante el env\u00edo simult\u00e1neo de m\u00faltiples solicitudes de inicio de sesi\u00f3n."}], "lastModified": "2025-10-15T14:13:31.663", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF2505C7-3CBB-4905-9C0D-46E199A052A8", "versionEndExcluding": "9.5.13", "versionStartIncluding": "9.5.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "992DBA77-028D-4913-B98B-1AC0FEFEAFBF", "versionEndExcluding": "9.11.5", "versionStartIncluding": "9.11.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3898CB89-EE8C-4463-B9CB-BDB2E2B1C9A8", "versionEndExcluding": "10.0.3", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF51BACA-F34A-40EC-8402-F71005556EE3", "versionEndExcluding": "10.1.3", "versionStartIncluding": "10.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}