CVE-2024-48872

CVE-2024-48872 affects Mattermost Server versions 10.1.x up to 10.1.2, 10.0.x up to 10.0.2, 9.11.x up to 9.11.4, and 9.5.x up to 9.5.12. This vulnerability is a race condition (CWE-362) that allows an attacker to bypass the "Max failed attempts" restriction. By simultaneously sending multiple login requests, an attacker can perform a high number of login attempts before being blocked, potentially leading to unauthorized access. Rated as Medium severity with a CVSS score of 4.8, the attack vector is network-based with high attack complexity and no user interaction required. The potential impact involves low confidentiality and integrity impacts, meaning an attacker could gain limited access or modify limited data. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, indicating a low level of public awareness or concern at this time.