CVE-2023-5969: Denial of Service via Link Preview in /api/v4/redirect_location

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2023-5969.

Q: What is the title of the vulnerability?

The title of the vulnerability is 'Denial of Service via Link Preview in /api/v4/redirect_location'.

Q: How does the vulnerability occur?

The vulnerability occurs when Mattermost fails to properly sanitize the request to /api/v4/redirect_location, allowing an attacker to fill up the memory due to caching large items.

Q: What is the severity of CVE-2023-5969?

The severity of CVE-2023-5969 is medium with a CVSS score of 5.3.

Q: How do I fix CVE-2023-5969?

To fix CVE-2023-5969, update Mattermost to version 9.0.1, 8.1.3, 8.0.4, or 7.8.12 depending on the affected version.

Published Nov 6, 2023

Updated

Mattermost fails to properly sanitize the request to /api/v4/redirectlocation allowing an attacker, sending a specially crafted request to /api/v4/redirectlocation, to fill up the memory due to caching large items.

Other sources

Affected Software

8 affected componentsFixes available

go/github.com/mattermost/mattermost/server/v8=9.0.0

9.0.1

go/github.com/mattermost/mattermost/server/v8>=8.1.0<8.1.3

8.1.3

go/github.com/mattermost/mattermost/server/v8>=8.0.0<8.0.4

8.0.4

go/github.com/mattermost/mattermost-server/v6<7.8.12

7.8.12

Mattermost Mattermost<=7.8.11

Mattermost Mattermost>=8.0.0<=8.0.3

Mattermost Mattermost>=8.1.0<=8.1.2

Mattermost Mattermost=9.0.0

Remediation

Information

Update Mattermost Server to versions 7.8.12, 8.0.4, 8.1.3, 9.0.1 or higher.

Event History

Nov 6, 2023

CVE Published

via MITRE·03:48 PM

Data Sourced

via MITRE·03:48 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Advisory Published

06:30 PM

Frequently Asked Questions

What is the vulnerability ID?