CVE-2023-49809: Todo plugin gets crashed and disabled by member
Published Dec 12, 2023
·Updated
Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled.
Affected Software
2 affected components
Mattermost Mattermost Server<=8.1.5
Mattermost Mattermost Server>=9.0.0<=9.1.0
Remediation
Information
Update Mattermost Server to versions 8.1.6, 9.2.0 or higher
Event History
Dec 12, 2023
CVE Published
08:20 AM
Data Sourced
08:20 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-49809?
CVE-2023-49809 is classified as a denial-of-service vulnerability affecting Mattermost.
2
How do I fix CVE-2023-49809?
To mitigate CVE-2023-49809, users should upgrade to Mattermost Server version 9.1.0 or later.
3
What specific issue does CVE-2023-49809 cause?
CVE-2023-49809 allows a simple member to crash the Mattermost server by sending a request with a null request body to the /add endpoint.
4
Who is affected by CVE-2023-49809?
CVE-2023-49809 affects Mattermost Server versions up to 8.1.5 and between 9.0.0 and 9.1.0.
5
What happens when CVE-2023-49809 is exploited?
Exploiting CVE-2023-49809 can disable the plugin after repeated crashes caused by null requests.