Thecybertantrik

**Name of the Vulnerable Software and Affected Versions** Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14 **Description** Failure to enforce request body size limits on plugin HTTP endpoints allows an attacker to cause a denial of service by sending crafted oversized HTTP requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mattermost Plugins versions 10.11.11.0 and 11.4 **Description** Mattermost plugins do not properly validate timestamps in webhook requests. This allows an attacker to repeatedly send webhook requests, potentially corrupting the state of Zoom meetings within Mattermost. The issue involves the replay of webhook requests. **Recommendations** Update Mattermost Plugins to a version newer than 11.4. Update Mattermost Plugins to a version newer than 10.11.11.0.

**Name of the Vulnerable Software and Affected Versions** Mattermost Plugins versions 10.11.11.0 through 11.4 **Description** The software does not properly check the size of incoming requests, potentially allowing an authenticated attacker to disrupt service through the webhook endpoint. The issue affects the processing of requests sent to the `/webhooks` API endpoint. The `request size` is not validated, which can lead to a denial-of-service condition. **Recommendations** Update to a version of Mattermost Plugins greater than 11.4.