title: Denial of Service via Board Import Zip Bomb
description: Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).
problem types: CWE-400: Uncontrolled Resource Consumption
affected:
{
defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 7.8.12, status: affected, version: 0, versionType: semver
lessThanOrEqual: 8.1.3, status: affected, version: 0, versionType: semver
lessThanOrEqual: 9.0.1, status: affected, version: 0, versionType: semver
lessThanOrEqual: 9.1.0, status: affected, version: 0, versionType: semver
status: unaffected, version: 9.1.1
status: unaffected, version: 9.0.2
status: unaffected, version: 7.8.13
status: unaffected, version: 8.1.4
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Mattermost Server to versions 9.1.1, 9.0.2, 7.8.13, 8.1.4 or higher.