Skip to content
OpenAdvisories
Medium WID-SEC-2023-2590 3 CVEs

Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierte Angriffe

Published Oct 8, 2023 · Updated Oct 9, 2023 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Product: Mattermost < 7.8.12 Product: Mattermost < 8.0.4 Product: Mattermost < 8.1.3 Product: Mattermost < 9.0.1 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 3

  • Medium 4.3
    CVE-2023-5330

    Denial of Service via Opengraph Data Cache

    Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4/opengraph filling the cache and turning the server unavailable.

    Mattermost Mattermost
  • Medium 4.3
    CVE-2023-5331

    File Information Leak via IDOR in file_id in Draft Posts

    Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.

    Mattermost Mattermost
  • Medium 4.3
    CVE-2023-5333

    Denial of Service via multiple identical User IDs in /api/v4/users/ids

    Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specially crafted request to /api/v4/users/ids with multiple identical IDs.

    Mattermost Mattermost

Revision history

  1. #2

    CVE-Nummern ergänzt

  2. #1

    Initiale Fassung

References