Moderate severityNVD Advisory· Published Nov 6, 2023· Updated Sep 17, 2024

Denial of Service via Link Preview in /api/v4/redirect_location

CVE-2023-5969

Description

Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up the memory due to caching large items.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/mattermost/mattermost-server/v6Go	< 7.8.12	7.8.12
github.com/mattermost/mattermost/server/v8Go	>= 8.0.0, < 8.0.4	8.0.4
github.com/mattermost/mattermost/server/v8Go	>= 8.1.0, < 8.1.3	8.1.3
github.com/mattermost/mattermost/server/v8Go	>= 9.0.0, < 9.0.1	9.0.1

Affected products

ghsa-coords2 versions
pkg:golang/github.com/mattermost/mattermost-server/v6 pkg:golang/github.com/mattermost/mattermost/server/v8
< 7.8.12+ 1 more
- (no CPE)range: < 7.8.12
- (no CPE)range: >= 8.0.0, < 8.0.4
Mattermost/Mattermostv5
Range: 0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-w496-f5qq-m58jghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-5969ghsaADVISORY
github.com/mattermost/mattermost/commit/77f094c7ee8c7a00be01c2df72f948a62c690b66ghsaWEB
github.com/mattermost/mattermost/pull/24429ghsaWEB
mattermost.com/security-updatesghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000