LiveActive security incident?Get immediate response
CVE Record

CVE-2022-2406: Malicious imports can lead to Denial of Service

The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.

MediumCVSS 4.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Mattermost’s legacy Slack import feature could let a logged-in attacker crash the server by importing oversized files. The expected business impact is service disruption, not data theft or tampering, based on the provided CVSS and description.

Executive priority

Treat as a moderate availability risk for collaboration services. Prioritize remediation where Mattermost is internet-accessible, broadly user-accessible, or operationally critical. This is less urgent than unauthenticated remote code execution, but outages can still affect business continuity.

Technical view

Mattermost 6.7.0 and earlier did not sufficiently limit imported file sizes in the legacy Slack import REST API. An authenticated, low-privilege network attacker could trigger resource exhaustion and cause a denial of service. The issue maps to CWE-400.

Likely exposure

Exposure is limited to Mattermost deployments running 6.7.0 or earlier, including listed 6.4.x, 6.5.x, 6.6.x, and 6.7.x versions. Risk depends on whether authenticated users can access the legacy Slack import REST API.

Exploitation context

The provided sources do not show active exploitation, and KEV is false. Exploitation requires authentication and API access. The stated impact is availability loss from server crash, with no cited confidentiality or integrity impact.

Researcher notes

Evidence is narrow but consistent: authenticated oversized Slack imports can crash Mattermost due to insufficient resource limits. The bundle does not identify fixed versions, exploit maturity, or vendor-specific workarounds beyond the Mattermost security updates reference.

Mitigation direction

  • Check Mattermost security updates for fixed release guidance.
  • Upgrade affected Mattermost deployments according to vendor guidance.
  • Identify and retire Mattermost 6.7.0 or earlier where present.
  • Restrict Slack import access to trusted administrators until remediated.
  • Monitor for unusually large imports and related server crashes.

Validation and detection

  • Inventory Mattermost versions and flag 6.7.0 or earlier.
  • Confirm whether the legacy Slack import REST API is enabled or reachable.
  • Review logs for large import attempts before server instability.
  • Verify the deployed version against Mattermost security update guidance.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-400: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-2406 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L2.81.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.3Medium
CVSS 3.1 vector shape for CVE-2022-2406Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
MattermostMattermostunspecified, 6.4.x, 6.7.x 6.7.0, 6.5.x, 6.6.xListed
Weakness

CWE details

CWE-400

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.