File Size Limitations in Mattermost Lead to Potential Denial of Service Vulnerability

CVE-2024-54682

Summary

CVE-2024-54682 identifies a critical vulnerability in Mattermost that affects specific versions of its communication platform. The issue arises from the absence of enforced file size limits during the import of Slack files. This oversight permits a team administrator to import a maliciously crafted zip file, known as a zip bomb, potentially leading to a Denial of Service (DoS). By exploiting this vulnerability, an attacker could overwhelm the server, significantly degrading or disabling service for users. Organizations utilizing affected versions of Mattermost should prioritize updating their software to mitigate this risk.

References