CVE-2023-49809 — Todo plugin gets crashed and disabled by member

CVE-2023-49809

Todo plugin gets crashed and disabled by member PUBLISHED

Description (CNA)

Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 8.1.5; unaffected 8.1.6; unaffected 9.2.0

CWE

CWE-400

References

https://mattermost.com/security-updates

ADP enrichment

CVE

No English description supplied.

https://mattermost.com/security-updates