PT-2022-16440 · Mattermost · Mattermost

Juho Nurminen · Published 2022-07-14 · Updated 2023-06-30 · CVE-2022-2406

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 6.7.0 and earlier

Description The legacy Slack import feature fails to properly limit the sizes of imported files, allowing an authenticated attacker to crash the server by importing large files via the Slack import REST API.

Recommendations For Mattermost versions 6.7.0 and earlier, consider disabling the legacy Slack import feature until a patch is available to prevent server crashes due to large file imports.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2022-2406

Affected Products

Mattermost

References · 5

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2406 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2406 · Vendor Advisory
• https://t.me/cvenotify/33084 · Telegram Post
• https://t.me/cibsecurity/46272 · Telegram Post