PT-2022-16440 · Mattermost · Mattermost
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Mattermost versions 6.7.0 and earlier
Description
The legacy Slack import feature fails to properly limit the sizes of imported files, allowing an authenticated attacker to crash the server by importing large files via the Slack import REST API.
Recommendations
For Mattermost versions 6.7.0 and earlier, consider disabling the legacy Slack import feature until a patch is available to prevent server crashes due to large file imports.
Exploit
Fix
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mattermost