CVE-2022-3147

Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource exhaustion on specific system configurations, resulting in server-side Denial of Service.

Score

CVSS 3.1 6.5 Medium

Status

Modified - responsibledisclosure@mattermost.com

Published

2022-09-09

Last modified

2024-12-06

Weaknesses

CWE-400, CWE-770

Affected products

• Mattermost (Mattermost)
• Mattermost Server (Mattermost)

References

• https://hackerone.com/reports/1549513
• https://mattermost.com/security-updates/