CVE-2022-3257CWE-400

Server-side Denial of Service while processing a specifically crafted GIF file

Low · published September 23, 2022

CVSS v3.1
3.1
EPSS
1%
Percentile
69.4
In the wild
Unconfirmed
What it is

Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01260 · 69.4th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2022-09-23T14:13Z
EPSS history
Timeline
  • 23 SEP 14:13Z
    Server-side Denial of Service while processing a specifically crafted GIF file
    cvelistv5