Skip to content
OpenAdvisories
Medium · 4.3 CVE-2023-49607 EUVD-2023-53555GHSA-g6qp-9v7f-3wh3

Playbook plugin crash via missing interface type assertion

Published Dec 12, 2023 · Updated Aug 2, 2024 · Assigned by Mattermost

Description

Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 8.1.5, ≤ 9.0.3, ≤ 9.1.2, ≤ 9.2.1 9.2.2

References