Medium · 4.3 CVE-2022-4019 EUVD-2022-51398GHSA-hqqj-g6mv-rw46

Authenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost server

Published Nov 23, 2022 · Updated Dec 6, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Playbooks Plugin

Description

A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints.

Affected products

Vendor	Product	Affected	Fixed
Mattermost	Playbooks Plugin	1.0.0 – ≤ 7.1.3, 7.2.0 – < 7.2.1, 7.3.0 – < 7.3.1	7.1.4

Advisories 1

WID-SEC-2022-2154 Mattermost: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 27, 2022

References

https://mattermost.com/security-updates/
https://hackerone.com/reports/1685979

CNA	v3.1	4.3
EUVD	v3.1	4.3