Vulnerability · Published Nov 23, 2022 · Assigned by Mattermost
CVE-2022-4019Authenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost server
Medium 4.3
In plain English
A medium-severity resource allocation without limits in Playbooks Plugin from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.8%top 43.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Playbooks Plugin | 1.0.0 – through 7.1.37.2.0 – before 7.2.17.3.0 – before 7.3.1 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L