What is GHSA-v647-h8jj-fw5r?

GHSA-v647-h8jj-fw5r is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost Data Amplification vulnerability

Which CVE IDs does GHSA-v647-h8jj-fw5r cover?

GHSA-v647-h8jj-fw5r covers the following CVE IDs: CVE-2024-54682. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v647-h8jj-fw5r?

GHSA-v647-h8jj-fw5r has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-v647-h8jj-fw5r?

GHSA-v647-h8jj-fw5r affects 4 products, including: go/github.com/mattermost/mattermost/server/v8:\u003e= 10.1.0, \u003c 10.1.3; go/github.com/mattermost/mattermost/server/v8:\u003e= 10.0.0, \u003c 10.0.3; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.11.0, \u003c 9.11.5; go/github.com/mattermost/mattermost/server/v8:\u003e= 9.5.0, \u003c 9.5.13.

GHSA-v647-h8jj-fw5rMediumCVSS 6.5

Mattermost Data Amplification vulnerability

Vendor

GitHub Security Advisories

Published

December 16, 2024

Last Modified

December 16, 2024

🔗 CVE IDs covered (1)

CVE-2024-54682 →

📋 Description

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin.

🎯 Affected products4

go/github.com/mattermost/mattermost/server/v8:>= 10.1.0, < 10.1.3
go/github.com/mattermost/mattermost/server/v8:>= 10.0.0, < 10.0.3
go/github.com/mattermost/mattermost/server/v8:>= 9.11.0, < 9.11.5
go/github.com/mattermost/mattermost/server/v8:>= 9.5.0, < 9.5.13

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-54682
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-v647-h8jj-fw5r