← Back

CVE-2024-54682

nvd nist
Published: Dec 16, 2024Modified: Jun 17, 2026

JSON object

Loading...
4.9
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Exploitability: 1.2 / Impact: 3.6
Source: NVD

Description

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin.

Affected (4)

Mattermost
1 product
Mattermost Server
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost
Mattermost Server
From 10.0.0 to 10.0.3
Mattermost Server
From 10.1.0 to 10.1.3
Mattermost Server
From 9.11.0 to 9.11.5
Mattermost Server
From 9.5.0 to 9.5.13

Related CWEs

CWE-409
Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

References (1)

Source: responsibledisclosure@mattermost.com
Vendor Advisory

Timeline

No history available yet.