Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2026-21388 · ADVISORY
• mattermost/mattermost-plugin-msteams commit 6fe4d29 · WEB
• mattermost/mattermost-plugin-msteams · PACKAGE
• mattermost/mattermost-plugin-msteams release v2.3.2 · WEB
• mattermost.com/security-updates · WEB
• GitHub Advisory GHSA-x274-8qfc-hrgf · ADVISORY

Lỗ hổng khác của github.com/mattermost/mattermost-plugin-msteams

• CVE-2026-24661TRUNG BÌNH 6.5Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated…
• CVE-2026-2476TRUNG BÌNH 4.3Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support p…
• CVE-2025-27936TRUNG BÌNH 5.9Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform co…