CVE-2023-49607: Playbook plugin crash via missing interface type assertion

Q: What is the severity of CVE-2023-49607?

CVE-2023-49607 is assigned a severity rating based on its potential impact on the Mattermost server, which may allow service disruption.

Q: How do I mitigate CVE-2023-49607?

To mitigate CVE-2023-49607, you should update your Mattermost server to the latest version that addresses this vulnerability.

Q: What versions of Mattermost are affected by CVE-2023-49607?

CVE-2023-49607 affects Mattermost server versions up to 7.8.14, as well as various versions between 8.0.0 and 9.2.1.

Q: Can CVE-2023-49607 lead to a denial of service?

Yes, CVE-2023-49607 can potentially cause a denial of service by crashing the Playbook Plugin when the status dialog is updated.

Q: Is there a patch available for CVE-2023-49607?

Yes, a patch for CVE-2023-49607 is included in the latest releases of the Mattermost server, which should be applied immediately.

Published Dec 12, 2023

Updated

Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog.

Affected Software

6 affected components

Mattermost Mattermost Server<=7.8.14

Mattermost Mattermost Server>=8.0.0<=8.1.5

Mattermost Mattermost Server>=9.0.0<=9.0.3

Mattermost Mattermost Server>=9.1.0<=9.1.2

Mattermost Mattermost Server>=9.2.0<=9.2.1

Mattermost Mattermost Server=9.1.1

Remediation

Information

Update Mattermost Plugins to versions 9.2.2, 8.1.6, 9.0.4, 9.1.3 or higher.

Event History

Dec 12, 2023

CVE Published

08:21 AM

Data Sourced

08:21 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-49607?

CVE-2023-49607 is assigned a severity rating based on its potential impact on the Mattermost server, which may allow service disruption.

How do I mitigate CVE-2023-49607?