Description (CNA)
Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a CA path field, such as /dev/zero and, after testing the connection, cause the application to crash.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Mattermost / Mattermost | affected 9.5.0 through 9.5.7; affected 9.10.0; unaffected 9.11.0; unaffected 9.5.8; unaffected 9.10.1 |
CWE
CWE-400
References
ADP enrichment
No English description supplied.
No references supplied.