Skip to content
OpenAdvisories
Low WID-SEC-2022-2154 3 CVEs

Mattermost: Mehrere Schwachstellen ermöglichen Denial of Service

Published Nov 22, 2022 · Updated Nov 27, 2022 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 3

  • Medium 4.3
    CVE-2022-4019

    Authenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost server

    A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints.

    Mattermost Playbooks Plugin
  • Medium 4.3
    CVE-2022-4044

    Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server

    A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages.

    Mattermost Mattermost github.com/mattermost/mattermost-server Go
  • Low 3.1
    CVE-2022-4045

    Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost server

    A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data. 

    Mattermost Mattermost github.com/mattermost/mattermost-server Go

Revision history

  1. #2

    PoC aufgenommen

  2. #1

    Initiale Fassung

References