PT-2022-20747 · Mattermost · Mattermost

Philippe Antoine · Published 2022-09-09 · Updated 2024-03-06 · CVE-2022-3147

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 7.0.x and earlier

Description The issue allows authenticated users to cause resource exhaustion on specific system configurations, resulting in server-side Denial of Service, due to insufficient limitation of the in-memory sizes of concurrently uploaded JPEG images.

Recommendations For Mattermost versions 7.0.x and earlier, consider restricting the upload of JPEG images or limiting the concurrent upload capability to prevent resource exhaustion until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BIT-MATTERMOST-2022-3147

CVE-2022-3147

Affected Products

Mattermost

References · 6

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3147 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2022-3147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3147 · Security Note
• https://hackerone.com/reports/1549513 · Note
• https://t.me/cibsecurity/49535 · Telegram Post