CVE-2024-54682CWE-409

Zipbomb DoS via Missing Slack Import Validation

Medium · published December 16, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00443 · 37.5th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2024-12-16T08:03Z
EPSS history
Timeline
  • 16 DEC 08:03Z
    Zipbomb DoS via Missing Slack Import Validation
    cvelistv5