PT-2021-24341 · Mattermost · Mattermost

Agniva De · Published 2021-11-08 · Updated 2024-08-21 · CVE-2022-1337

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Mattermost versions 6.4.1 and earlier

Description: The issue is related to the image proxy component, which can lead to resource exhaustion. An authenticated attacker can cause the server to crash by linking to very large image files, resulting in memory allocation for multiple copies of the proxied image.

Recommendations: For Mattermost versions 6.4.1 and earlier, consider disabling the image proxy component as a temporary workaround until a patch is available. Restrict access to large image files to minimize the risk of exploitation.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BIT-MATTERMOST-2022-1337

CVE-2022-1337

GHSA-F37Q-Q7P2-CCFC

GO-2022-0595

Affected Products

Mattermost

References · 9

• https://osv.dev/vulnerability/CVE-2022-1337 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1337 · Security Note
• https://osv.dev/vulnerability/GO-2022-0595 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2022-1337 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f37q-q7p2-ccfc · Vendor Advisory
• https://github.com/mattermost/mattermost-server · Note
• https://github.com/advisories/GHSA-f37q-q7p2-ccfc · Note
• https://t.me/cybersecuritytechnologies/4701 · Telegram Post