CVE-2023-5196: DoS via Channel Notification Properties
Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notificationprop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming temporarily unavailable for its users.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-5196?
CVE-2023-5196 is a vulnerability in Mattermost that allows an attacker to send a really long value for a notification_prop, causing the server to consume an abnormal quantity of computing resources and possibly become temporarily unavailable.
How does CVE-2023-5196 impact Mattermost users?
CVE-2023-5196 can lead to server overload and unavailability, affecting the normal usage of Mattermost by its users.
What is the severity of CVE-2023-5196?
CVE-2023-5196 has a severity rating of medium with a CVSS score of 6.5.
Which versions of Mattermost are affected by CVE-2023-5196?
Mattermost versions up to and including 8.0.2 are affected by CVE-2023-5196.
How can I fix CVE-2023-5196?
To fix CVE-2023-5196, upgrade Mattermost to version 8.1.1 or later.