CVE-2022-4019Authenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost server

4.3MediumCVSS base score
0.79%Exploitation in 30 daysEPSS · top 43% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints.

Timeline

2022
16 Nov 2022
16 Nov 2022
ID reserved
By Mattermost
23 Nov 20227 days later
23 Nov 2022· 7 days later
Published
2024
6 Dec 20242 years later
6 Dec 2024· 2 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-4019, by who scored it
Scored by	CVSS	Score	Vector
MattermostCNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVDNVD · Modified	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 0.79% · top 43% of all CVEs (13 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Affected products

Mattermost · Playbooks Plugin
- affected 1.0.0 – ≤ 7.1.3
- unaffected 7.1.4 – ≤ 7.1.*
- affected 7.2.0 – < 7.2.1
- affected 7.3.0 – < 7.3.1
- unaffected 7.4.0

What to do

Solution: Update Mattermost to version v7.1.4, 7.2.1, 7.3.1, 7.4.0 or higher.

References2

https://mattermost.com/security-updates/ (opens in a new tab)x_transferred
https://hackerone.com/reports/1685979 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-4019](https://cveledger.app/badge/CVE-2022-4019.svg)](https://cveledger.app/cve/CVE-2022-4019)

Record last updated 6 Dec 2024, 23:07 UTC.