CVE-2022-4045 - Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost server

Back Back to CVE browser

MEDIUM

Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost server

Published Nov 23, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.64%

Description

A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data.

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <7.3.*
- Version
  7.4.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mattermost

unaffected

Version	Status	Constraints
0	affected	<7.3.*
7.4.0	unaffected	-

github.com/mattermost/mattermost-server

Go

Introduced 0 Fixed 7.1.4
github.com/mattermost/mattermost-server

Go

Introduced 7.2.0 Fixed 7.2.1
github.com/mattermost/mattermost-server

Go

Introduced 7.3.0 Fixed 7.3.1

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost-server	0	7.1.4
Go	github.com/mattermost/mattermost-server	7.2.0	7.2.1
Go	github.com/mattermost/mattermost-server	7.3.0	7.3.1

Remediation

Vendor solution

Update Mattermost to version v7.4.0 or higher.

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (3)

https://github.com/advisories/GHSA-v42f-hq78-8c5m
Advisory
https://mattermost.com/security-updates/
Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4045

Link	Providers	Tags
https://github.com/advisories/GHSA-v42f-hq78-8c5m		Advisory
https://mattermost.com/security-updates/		Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4045