Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-5969 EUVD-2023-3048GHSA-w496-f5qq-m58j

Denial of Service via Link Preview in /api/v4/redirect_location

Published Nov 6, 2023 · Updated Sep 17, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up the memory due to caching large items.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 7.8.11, ≤ 8.0.3, ≤ 8.1.2, ≤ 9.0.0 7.8.12

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server/v6 < 7.8.12 7.8.12 GHSA-w496-f5qq-m58j
Go github.com/mattermost/mattermost/server/v8 >= 8.0.0, < 8.0.4 8.0.4 GHSA-w496-f5qq-m58j
Go github.com/mattermost/mattermost/server/v8 >= 8.1.0, < 8.1.3 8.1.3 GHSA-w496-f5qq-m58j
Go github.com/mattermost/mattermost/server/v8 >= 9.0.0, < 9.0.1 9.0.1 GHSA-w496-f5qq-m58j

References