Mattermost Confluence Plugin Channel Subscription Endpoint Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Mattermost Confluence Plugin, specifically in versions prior to 1.5.0. The issue arises because the plugin does not properly manage unexpected request bodies, allowing attackers to crash the plugin by repeatedly sending invalid requests to the channel subscription creation endpoint.

Impact

Exploitation of this vulnerability leads to a crash of the Confluence plugin, causing a denial-of-service condition where the plugin becomes unresponsive or unavailable.

Remediation

Users can upgrade to Mattermost Confluence Plugin version 1.5.0 or later to address this vulnerability.