Vulnerability · Published Apr 13, 2022 · Assigned by Mattermost
CVE-2022-1333A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of Service
Low 3.5
In plain English
A low-severity resource allocation without limits in Mattermost Playbooks from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.7%top 45.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost Playbooks | Playbooks – through 1.24 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
References
- https://mattermost.com/security-updates/ x_refsource_MISC