CVE-2022-1982

Summary

Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost6.5.x 6.5.0affected
MattermostMattermost6.6.x 6.6.0affected
MattermostMattermost5.x <= 5.39affected
MattermostMattermost6.x <= 6.3.7affected
MattermostMattermost6.4.x <= 6.4.2affected

Weaknesses

  • CWE-400: CWE-400 Uncontrolled Resource Consumption

Workarounds

Configure the maximum file size for message attachments to 20 megabytes or less: https://docs.mattermost.com/configure/configuration-settings.html#maximum-file-size

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References