« Volver al listado

CVE-2023-48369

Estado: ModificadaMedia (5.3)—

Mattermost no logra limitar el tamaño de los registros del servidor, lo que permite que un atacante envíe solicitudes especialmente manipuladas a diferentes endpoint para potencialmente desbordar el registro.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mattermost — Mattermost

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-48369",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "responsibledisclosure@mattermost.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "affectedData": [
        {
          "vendor": "Mattermost",
          "product": "Mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "7.8.12"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "8.1.3"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "9.0.1"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "9.1.0"
            },
            {
              "status": "unaffected",
              "version": "9.0.2"
            },
            {
              "status": "unaffected",
              "version": "9.1.1"
            },
            {
              "status": "unaffected",
              "version": "7.8.13"
            },
            {
              "status": "unaffected",
              "version": "8.1.4"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-11-27T10:15:08.400",
  "references": [
    {
      "url": "https://mattermost.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "responsibledisclosure@mattermost.com"
    },
    {
      "url": "https://mattermost.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsibledisclosure@mattermost.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log. \n\n"
    },
    {
      "lang": "es",
      "value": "Mattermost no logra limitar el tamaño de los registros del servidor, lo que permite que un atacante envíe solicitudes especialmente manipuladas a diferentes endpoint para potencialmente desbordar el registro."
    }
  ],
  "lastModified": "2026-06-17T06:34:07.323",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BAEFCB9C-4CFC-4C2D-B53D-4A1E9B54E744",
              "versionEndIncluding": "7.8.12"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CFE72E8-D2A6-4994-88F6-2B04DB413631",
              "versionEndIncluding": "8.1.3",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF5E1B7D-7237-4464-9873-0A85C80CC76A",
              "versionEndIncluding": "9.0.1",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost:9.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D960BDC-FB30-4112-B1CC-219D1EC32145"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com"
}