CVE-2022-4019: mattermost
CVSS: 6.5v3.1MediumModified
AliasesCGA-3823-jrjp-x659CGA-44cc-vfw5-x7jfCGA-4x32-gqmw-gv73CGA-6c5m-9cw9-cjvrCGA-9v52-rfxg-p2wfCGA-frgq-v853-7vj4CGA-h3r6-9ph2-xx7vCGA-p5cj-p4fm-vcc8CGA-q3wc-qjxx-23r3CGA-r9pv-3hrc-99r9CGA-4vf8-f2wf-4h7xCGA-5cgw-54rx-qf73CGA-685r-8wpv-qmpxCGA-7fjh-8cj2-r5fmCGA-92gr-236w-9638CGA-9qrq-p9vm-v7mrCGA-fwm6-547c-cv6pCGA-g8j2-m2wm-33wfCGA-hh25-82vm-fphfCGA-jrx3-fx7c-m3fmCGA-qfjj-rr39-93mfCGA-qwwx-6h2h-j6p5CGA-rcqh-r4h6-3rh2CGA-vfv4-x29j-h4r5CGA-xf4f-5266-86xwCGA-xfc5-36fh-5grvCGA-m5mj-7q2w-32wpCGA-mwx8-xf86-j64h
Published 23-11-2022Last modified 06-12-2024
Vulnerability summary
CVE-2022-4019 is a medium (CVSS 6.5) vulnerability in mattermost. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 55% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
0.77%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 7Timeline
- 23-11-2022PublishedVulnerability first disclosed.
- 06-12-2024Last modifiedVulnerability information updated.
Description
A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSources4 sources · 4.3–6.5
- CVE.orgCNA4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.77%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
+0.03 pp
From 0.75% on 20-09-2026
20-09-202620-10-2026
EPSS score0.77%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard14 products
- mattermost-10.11All versions (No fix recorded)
- mattermost-10.12All versions (No fix recorded)
- mattermost-11.0All versions (No fix recorded)
- mattermost-11.1All versions (No fix recorded)
- mattermost-11.10All versions (No fix recorded)
Wolfi5 products
- mattermost-11.1All versions (No fix recorded)
- mattermost-11.4All versions (No fix recorded)
- mattermost-11.5All versions (No fix recorded)
- mattermost-11.6All versions (No fix recorded)
- mattermost-11.7All versions (No fix recorded)
Mattermost2 products
- mattermostna
- playbooks plugin≥ 1.0.0, ≤ 7.1.3 | ≥ 7.2.0, < 7.2.1 | ≥ 7.3.0, < 7.3.1
3 vendors · 21 products