CVE-2023-48369

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	<= 7.8.12; <= 8.1.3; <= 9.0.1; <= 9.1.0

References

https://mattermost.com/security-updatesVendor Advisory
https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Nov 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-48378.8SmodBIP is vulnerable to Cross-Site Request Forgery, that could be used to induce logged in users to perform unintended actions, including c CVE-2023-483719.8ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can e CVE-2023-483729.8ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthenticated remote attacker can exploit this CVE-2023-483737.5ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote att CVE-2023-483746.5SmartStar Software CWS is a web-base integration platform, it has a vulnerability of using a hard-coded for a specific account with low priv CVE-2023-483758.8SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access dat CVE-2023-483769.8SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type CVE-2023-483787.5Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can e CVE-2023-483795.3Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific functio CVE-2023-48385.4The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to,CVE-2023-483808.0Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A CVE-2023-483816.5Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthentic