Skip to content
OpenAdvisories
Medium · 4.3 CVE-2022-4044 EUVD-2022-7242GHSA-5jph-wrq7-v9hf

Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server

Published Nov 23, 2022 · Updated Dec 6, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server Ecosystem: Go

Description

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost 1.0.0 – ≤ 7.1.3, 7.2.0 – < 7.2.1, 7.3.0 – < 7.3.1 7.1.4

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server < 7.1.4 7.1.4 GHSA-5jph-wrq7-v9hf
Go github.com/mattermost/mattermost-server >= 7.2.0, < 7.2.1 7.2.1 GHSA-5jph-wrq7-v9hf
Go github.com/mattermost/mattermost-server >= 7.3.0, < 7.3.1 7.3.1 GHSA-5jph-wrq7-v9hf

Advisories 1

References