GitHub Advisoryadvisory · Go

GHSA-3487-3j7c-7gwj Mattermost Uncontrolled Resource Consumption vulnerability

MEDIUM Published 2023-11-27 Modified 2023-12-04 Official page ↗
Aliases
CVE-2023-48369
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server/v6
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2023-11-28

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 9.1.0, < 9.1.1 → fixed in 9.1.1 • Go github.com/mattermost/mattermost/server/v8: >= 9.0.0, < 9.0.2 → fixed in 9.0.2 • Go github.com/mattermost/mattermost/server/v8: < 8.1.4 → fixed in 8.1.4 • Go github.com/mattermost/mattermost-server/v6: < 7.8.13 → fixed in 7.8.13

Description

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.

Related

Alias · CVE (1)

  • CVE-2023-48369 Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References