mattermost/mattermost-server · Security
Mattermost subject to Denial of Service via upload of special GIF
- GHSA ID
- GHSA-m7w4-q5vg-5xfp
- CVE ID
- CVE-2022-3257
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Description
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
CWEs
- CWE-434 · Unrestricted Upload of File with Dangerous Type