CVE-2023-48369: Log Flooding due to specially crafted requests in different endpoints
Published Nov 27, 2023
·Updated
Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.
Affected Software
8 affected componentsFixes available
go/github.com/mattermost/mattermost-server/v6<7.8.13
7.8.13
go/github.com/mattermost/mattermost/server/v8<8.1.4
8.1.4
go/github.com/mattermost/mattermost/server/v8>=9.0.0<9.0.2
9.0.2
go/github.com/mattermost/mattermost/server/v8>=9.1.0<9.1.1
9.1.1
Mattermost Mattermost<=7.8.12
Mattermost Mattermost>=8.0.0<=8.1.3
Mattermost Mattermost>=9.0.0<=9.0.1
Mattermost Mattermost=9.1.0
Remediation
Information
Update Mattermost Server to versions 9.0.2, 9.1.1, 7.8.13, 8.1.4 or higher.
Event History
Nov 27, 2023
CVE Published
via MITRE·09:10 AM
Data Sourced
via MITRE·09:10 AM
RemedyDescriptionSeverityWeakness
Advisory Published
12:30 PM
Frequently Asked Questions
1
What is CVE-2023-48369?
CVE-2023-48369 is a vulnerability in Mattermost that allows an attacker to flood server logs with specially crafted requests.
2
How does CVE-2023-48369 impact Mattermost?
CVE-2023-48369 can cause the log size of Mattermost server logs to overflow, potentially leading to a denial-of-service condition.
3
What is the severity of CVE-2023-48369?
CVE-2023-48369 has a severity rating of 4.3 (medium).
4
How can I fix CVE-2023-48369?
To fix CVE-2023-48369, update Mattermost to version 7.8.13, 8.1.4, 9.0.2, or 9.1.1 depending on your current version.
5
Where can I find more information about CVE-2023-48369?
You can find more information about CVE-2023-48369 on the Mattermost website, NIST NVD, and GitHub Advisory.