Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
Solution:
The product does not properly control the allocation and maintenance of a limited resource.
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
| Link | Tags |
|---|---|
| https://mattermost.com/security-updates/ | vendor advisory |
| https://hackerone.com/reports/1620170 | third party advisory exploit |