CVE-2023-5196

Summary

Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming temporarily unavailable for its users.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost0 <= 7.8.9affected
MattermostMattermost8.1.0affected
MattermostMattermost0 <= 8.0.1affected
MattermostMattermost7.8.10unaffected
MattermostMattermost8.1.1unaffected
MattermostMattermost8.0.2unaffected

Weaknesses

  • CWE-400: CWE-400 Uncontrolled Resource Consumption

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References