CVE-2023-40703 - OpenCVE

Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading to Denial of Service, by patching the field of a block using a specially crafted string.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mattermost	Mattermost

Configuration 1 [-]

OR	cpe:2.3:a:mattermost:mattermost::::::::
	cpe:2.3:a:mattermost:mattermost::::::::
	cpe:2.3:a:mattermost:mattermost::::::::
	cpe:2.3:a:mattermost:mattermost:9.1.0:::::::*

No data.

References

Link	Providers
https://mattermost.com/security-updates

History

No history.

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2023-11-27T09:08:31.251Z

Updated: 2024-08-02T18:38:51.081Z

Reserved: 2023-11-22T11:18:57.610Z

Link: CVE-2023-40703

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-11-27T10:15:07.460

Modified: 2023-12-01T19:13:28.487

Link: CVE-2023-40703

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-40703", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2023-11-22T11:18:57.610Z", "datePublished": "2023-11-27T09:08:31.251Z", "dateUpdated": "2024-08-02T18:38:51.081Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "7.8.12", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "8.1.3", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "9.0.1", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "9.1.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "9.1.1"}, {"status": "unaffected", "version": "9.0.2"}, {"status": "unaffected", "version": "7.8.13"}, {"status": "unaffected", "version": "8.1.4"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "vultza (vultza)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to <span style=\"background-color: rgb(255, 255, 255);\">consume excessive resources, possibly leading to Denial of Service, by</span> patching the field of a block using a specially crafted string. </p>"}], "value": "Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing\u00a0a attacker to\u00a0consume excessive resources, possibly leading to Denial of Service, by\u00a0patching the field of a block using a specially crafted string.\u00a0\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2023-11-27T09:08:31.251Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost Server to versions 9.1.1, 9.0.2, 7.8.13, 8.1.4 or higher.</p>"}], "value": "Update Mattermost Server to versions 9.1.1, 9.0.2, 7.8.13, 8.1.4 or higher.\n\n"}], "source": {"advisory": "MMSA-2023-00219", "defect": ["https://mattermost.atlassian.net/browse/MM-53233"], "discovery": "EXTERNAL"}, "title": "Denial of Service via specially crafted block fields in Mattermost Boards", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:38:51.081Z"}, "title": "CVE Program Container", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*", "matchCriteriaId": "BAEFCB9C-4CFC-4C2D-B53D-4A1E9B54E744", "versionEndIncluding": "7.8.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*", "matchCriteriaId": "7CFE72E8-D2A6-4994-88F6-2B04DB413631", "versionEndIncluding": "8.1.3", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF5E1B7D-7237-4464-9873-0A85C80CC76A", "versionEndIncluding": "9.0.1", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost:9.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "9D960BDC-FB30-4112-B1CC-219D1EC32145", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing\u00a0a attacker to\u00a0consume excessive resources, possibly leading to Denial of Service, by\u00a0patching the field of a block using a specially crafted string.\u00a0\n\n"}, {"lang": "es", "value": "Mattermost no logra limitar adecuadamente los caracteres permitidos en diferentes campos de un bloque en Mattermost Boards, lo que permite a un atacante consumir recursos excesivos, lo que posiblemente lleve a una Denegaci\u00f3n de Servicio, al parchear el campo de un bloque usando una cadena especialmente manipulada."}], "id": "CVE-2023-40703", "lastModified": "2023-12-01T19:13:28.487", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}, "published": "2023-11-27T10:15:07.460", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}