Vulnerability · Published Oct 9, 2023 · Assigned by Mattermost
CVE-2023-5333 Denial of Service via multiple identical User IDs in /api/v4/users/ids
Medium 4.3
In plain English
A medium-severity uncontrolled resource consumption in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.6%top 51.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specially crafted request to /api/v4/users/ids with multiple identical IDs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 0 – through 7.8.100 – through 8.0.20 – through 8.1.1 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L