CVE-2022-1333
Assigner: Mattermost
Published: 2022-04-13T17:06:01
State: PUBLISHED
affected: product: Mattermost Playbooks
vendor: Mattermost 
versions: lessThanOrEqual: 1.24
status: affected
version: Playbooks
versionType: custom
credits: value: Thanks to Rohitesh Gupta for contributing to this improvement under the Mattermost responsible disclosure policy.
descriptions: value: Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
problemTypes: descriptions: cweId: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
type: CWE
solutions: value: Update Mattermost Playbooks Plugin to version v1.25.0 or higher.  
source: advisory: MMSA-2022-0093
defect: https://mattermost.atlassian.net/browse/MM-41918
discovery: INTERNAL
title: A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of Service
x_generator: engine: Vulnogram 0.0.9