PT-2022-10682 · Mattermost · Mattermost

Published 2022-01-18 · Updated 2022-01-24 · CVE-2021-37865

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 6.2 and earlier

Description The issue arises from insufficient processing of a specifically crafted GIF file when uploaded while drafting a post. This allows authenticated users to cause resource exhaustion, resulting in a server-side Denial of Service.

Recommendations For versions 6.2 and earlier, update to a version later than 6.2 to resolve the issue. As a temporary workaround, consider restricting the upload of GIF files or limiting the resources available for processing uploaded files to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-37865

Affected Products

Mattermost

References · 4

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37865 · Security Note
• https://hackerone.com/reports/1428260 · Note