CVE-2024-48872 — Bypass of "Max failed attempts" restriction via race condition
Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which…
Published: 2024-12-16 · CVSS: 4.8 · CVSS 3.1
Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being blocked via simultaneously sending multiple login requests
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7