CVE-2022-4019 MEDIUM

CVE-2022-4019: Authenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost server

Vendor Mattermost

Product Playbooks Plugin

Weakness CWE-770 · Uncontrolled resource consumption

Published November 23, 2022

Last update December 6, 2024

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints.

Key dates

02Disclosure timeline

November 23, 2022 CVE published

December 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-4019 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/770.html

Related vulnerabilities

Identifiers

CVE CVE-2022-4019

CWE CWE-770

CVSS 4.3 / MEDIUM

Affected versions

Vendor Mattermost

Product Playbooks Plugin

Affected ≥ 1.0.0 and ≤ 7.1.3

Vendor Mattermost

Product Playbooks Plugin

Affected ≥ 7.2.0 and < 7.2.1

Vendor Mattermost

Product Playbooks Plugin

Affected ≥ 7.3.0 and < 7.3.1

CVE-2022-4019: Authenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost server

01Description

02Disclosure timeline

03References

04Related CVE