Veracode Vulnerability DatabaseVERACODE:41025Denial Of Service (DoS)
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
32.7%
github.com/mattermost/mattermost-server is vulnerable to Denial Of Service (DoS). The vulnerability exists because the getImagesForPost function of post_metadata.go does not properly validate the links on external websites when constructing a preview for a linked website, allowing an attacker to cause an application crash due to rendering the message preview.
References
github.com/advisories/GHSA-7qj9-mfh7-vg26
github.com/mattermost/mattermost/commit/218f3162e8b5a34bebdcd3cd9a433a77c90eab0d
github.com/mattermost/mattermost/commit/4c423ebf90802fd87b02116aa05abfba0234e442
github.com/mattermost/mattermost/commit/e1e45e5a7afeb4eab4a781006d7f8f61a686c342
mattermost.com/security-updates/
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
32.7%