Lucene search

K
osvGoogleOSV:GHSA-P2WQ-4GGP-45F3
HistoryApr 26, 2024 - 9:30 a.m.

Mattermost fails to limit the size of a request path

2024-04-2609:30:34
Google
osv.dev
7
mattermost
versions 8.1.x
9.6.x
9.5.x
excessive resource consumption
dos

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

3.9

Confidence

High

EPSS

0

Percentile

9.0%

Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

3.9

Confidence

High

EPSS

0

Percentile

9.0%