Veracode Vulnerability DatabaseVERACODE:45432Denial Of Service (DoS)
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
6.7 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.1%
Mattermost is vulnerable to Denial of Service (DoS). The vulnerability is caused due to the lack of validation for custom emoji reactions. This allows an attacker to send a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post.
References
github.com/advisories/GHSA-32h7-7j94-8fc2
github.com/mattermost/mattermost/commit/64cb0ca8af2dbda1afcddd1604460591a4799b81
github.com/mattermost/mattermost/commit/6d2440de9fd774b67e65e3aac4ab8b6ef9aba2d8
github.com/mattermost/mattermost/commit/81190e2da128a6985914ea7023a69ac400513fc4
mattermost.com/security-updates
mattermost.com/security-updates/
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
6.7 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.1%