CVE-2023-5967: Denial of Service via crashing the Calls Plugin
Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5967?
The severity of CVE-2023-5967 is medium, with a severity value of 4.3.
How does CVE-2023-5967 affect Mattermost?
CVE-2023-5967 affects Mattermost by allowing an attacker to crash the Calls plugin through a denial of service attack.
How can I exploit CVE-2023-5967?
To exploit CVE-2023-5967, an attacker can send a request to the Calls plugin without a User Agent header, causing a panic and crashing the plugin.
How do I fix CVE-2023-5967?
To fix CVE-2023-5967, upgrade Mattermost to version 7.8.12, 8.0.4, 8.1.3, or 9.0.1 depending on your current version.
Where can I find more information about CVE-2023-5967?
More information about CVE-2023-5967 can be found at the following references: [Mattermost Security Updates](https://mattermost.com/security-updates), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-5967), and [GitHub Advisories](https://github.com/advisories/GHSA-xvq6-h898-wcj8).