Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-5876: Regex DoS from a malicious server enrolled in Desktop

CVE-2023-5876 · published 3 years ago

Summary

Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service.

What to do

Update mattermost mattermost_desktop to version 5.5.1 or later.

Affected software

Vendor	Product	Affected versions
mattermost	mattermost_desktop	< 5.5.1 `cpe:2.3:a:mattermost:mattermost_desktop::::::::`

Original advisory text

Regex DoS from a malicious server enrolled in Desktop

Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service.

References

https://mattermost.com/security-updates URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5876.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-5876 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-400Uncontrolled Resource Consumption

Timeline

Published2 Nov 2023

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2023-5876 · NVD

CVE-2023-5876 · OSV

Track software like this

Free during beta