title: Malicious imports can lead to Denial of Service
description: The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
problem types: CWE-400 Uncontrolled Resource Consumption
affected:
{
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 6.3.8, status: affected, version: unspecified, versionType: custom
status: affected, version: 6.4.x
status: affected, version: 6.7.x 6.7.0
lessThanOrEqual: 6.5.1, status: affected, version: 6.5.x, versionType: custom
lessThanOrEqual: 6.6.1, status: affected, version: 6.6.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
]
solutions: Update Mattermost to version v7.0.0, 6.7.1, 6.6.2, 6.5.2, 6.3.9 or higher.