CVE-2024-54682
Zipbomb DoS via Missing Slack Import Validation
Résumé
Zipbomb DoS via Missing Slack Import Validation
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com