Lucene search

K
cvelistMattermostCVELIST:CVE-2023-2785
HistoryJun 16, 2023 - 9:07 a.m.

CVE-2023-2785 Specially crafted search query can cause large log entries in postgres

2023-06-1609:07:28
CWE-400
Mattermost
www.cve.org
cve-2023-2785
specially crafted search query
postgres error log
denial of service
mattermost

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.8 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.4%

Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation ofΒ large log filesΒ which can result in Denial of Service

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "7.1.9",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.8.4",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.9.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "7.10.0"
      },
      {
        "status": "unaffected",
        "version": "7.10.1"
      },
      {
        "status": "unaffected",
        "version": "7.9.4"
      },
      {
        "status": "unaffected",
        "version": "7.8.5"
      },
      {
        "status": "unaffected",
        "version": "7.1.10"
      }
    ]
  }
]

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.8 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.4%

Related for CVELIST:CVE-2023-2785