Skip to content
OpenAdvisories
Medium · 4.3 CVE-2023-49809 EUVD-2023-53718GHSA-478w-7mxw-36gh

Todo plugin gets crashed and disabled by member

Published Dec 12, 2023 · Updated Aug 2, 2024 · Assigned by Mattermost

Description

Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled. 

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 8.1.5 8.1.6

References