CVE-2023-5196 MEDIUM

CVE-2023-5196: DoS via Channel Notification Properties

Vendor Mattermost
Product Mattermost
Weakness CWE-400
Published September 29, 2023
Last update September 20, 2024

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming temporarily unavailable for its users.

Key dates

02Disclosure timeline

September 29, 2023 CVE published
September 20, 2024 Record updated