description: Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.
problem types: CWE-400: Uncontrolled Resource Consumption
affected:
{
defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 9.4.1, status: affected, version: 9.4.0, versionType: semver
status: affected, version: 9.3.0
lessThanOrEqual: 9.2.4, status: affected, version: 9.2.0, versionType: semver
lessThanOrEqual: 8.1.8, status: affected, version: 8.1.0, versionType: semver
status: unaffected, version: 9.5
status: unaffected, version: 9.4.2
status: unaffected, version: 9.3.1
status: unaffected, version: 9.2.5
status: unaffected, version: 8.1.9
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Mattermost Server to versions 9.5, 9.4.2, 9.3.1, 9.2.5, 8.1.9, or higher.