Mattermost
Page 4 of 7 — Mattermost CVEs from a corpus of 648, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39772 | Low | 3.7 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots vi… |
CVE-2024-45833 | Medium | 4.5 | 2024-09-16 | Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the… |
CVE-2024-39613 | Medium | 5.3 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an… |
CVE-2024-43105 | Medium | 4.3 | 2024-08-23 | Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by… |
CVE-2024-43780 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload fil… |
CVE-2024-42497 | Medium | 6.0 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems mana… |
CVE-2024-40884 | Low | 2.7 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission… |
CVE-2024-8071 | Medium | 4.7 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which a… |
CVE-2024-43813 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any… |
CVE-2024-42411 | Medium | 5.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to ma… |
CVE-2024-40886 | Medium | 4.6 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection… |
CVE-2024-39836 | Medium | 4.8 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or r… |
CVE-2024-39810 | Medium | 4.9 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a Sy… |
CVE-2024-32939 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original e… |
CVE-2024-41926 | Low | 2.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malici… |
CVE-2024-41162 | Medium | 4.1 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when sha… |
CVE-2024-41144 | Medium | 5.5 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled, w… |
CVE-2024-39839 | Medium | 4.3 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channel… |
CVE-2024-39837 | Low | 3.8 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, whe… |
CVE-2024-39832 | Medium | 6.8 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly safeguard an error handling which allows a malicious remote… |
CVE-2024-39777 | High | 8.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels… |
CVE-2024-39274 | High | 8.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync messa… |
CVE-2024-36492 | High | 7.4 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in share… |
CVE-2024-29977 | Low | 2.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remot… |
CVE-2024-39767 | Medium | 4.2 | 2024-07-15 | Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a m… |
CVE-2024-32945 | Low | 2.6 | 2024-07-15 | Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a… |
CVE-2024-6428 | Medium | 5.3 | 2024-07-03 | Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attack… |
CVE-2024-39830 | High | 8.1 | 2024-07-03 | Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison f… |
CVE-2024-39807 | Low | 3.1 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to… |
CVE-2024-39361 | Low | 3.1 | 2024-07-03 | Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an a… |
CVE-2024-39353 | Low | 2.7 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker… |
CVE-2024-36257 | Low | 2.7 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A request… |
CVE-2024-37182 | Medium | 4.7 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim ove… |
CVE-2024-36287 | Low | 3.8 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS. |
CVE-2024-5272 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event… |
CVE-2024-5270 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a… |
CVE-2024-36255 | Medium | 5.7 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run… |
CVE-2024-36241 | Low | 3.1 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents… |
CVE-2024-34152 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a publ… |
CVE-2024-34029 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<group-id>/channels/<… |
CVE-2024-32045 | Medium | 5.9 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playb… |
CVE-2024-31859 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in… |
CVE-2024-29215 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash co… |
CVE-2024-4198 | Low | 2.7 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin… |
CVE-2024-4195 | Low | 2.7 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team ad… |
CVE-2024-4183 | Medium | 4.3 | 2024-04-26 | Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows a… |
CVE-2024-4182 | Medium | 4.3 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which al… |
CVE-2024-32046 | Medium | 4.3 | 2024-04-26 | Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the devel… |
CVE-2024-22091 | Low | 3.1 | 2024-04-26 | Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs whic… |
CVE-2024-3872 | Low | 3.1 | 2024-04-16 | Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allows an unauthenticat… |
CVE-2024-2447 | Medium | 6.5 | 2024-04-05 | Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of pos… |
CVE-2024-29221 | Medium | 4.7 | 2024-04-05 | Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access cont… |
CVE-2024-28949 | Medium | 4.3 | 2024-04-05 | Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which all… |
CVE-2024-21848 | Low | 3.1 | 2024-04-05 | Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in… |
CVE-2024-2450 | High | 8.8 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switchi… |
CVE-2024-2446 | Medium | 4.3 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per me… |
CVE-2024-2445 | Medium | 6.1 | 2024-03-15 | Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to es… |
CVE-2024-28053 | Low | 3.1 | 2024-03-15 | Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker t… |
CVE-2024-24975 | Low | 3.5 | 2024-03-15 | Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails to limit the size of the code block that will be processed by the syntax hi… |
CVE-2024-1953 | Medium | 4.3 | 2024-02-29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowi… |
CVE-2024-1952 | Low | 3.1 | 2024-02-29 | Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated atta… |
CVE-2024-1949 | Low | 2.6 | 2024-02-29 | A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual p… |
CVE-2024-1942 | Medium | 4.3 | 2024-02-29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, w… |
CVE-2024-1888 | Medium | 4.3 | 2024-02-29 | Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members… |
CVE-2024-24988 | Medium | 4.3 | 2024-02-29 | Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string a… |
CVE-2024-23493 | Medium | 4.3 | 2024-02-29 | Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that… |
CVE-2024-23488 | Low | 3.1 | 2024-02-29 | Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived… |
CVE-2024-1887 | Medium | 4.3 | 2024-02-29 | Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to… |
CVE-2024-1402 | Medium | 4.3 | 2024-02-09 | Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, a… |
CVE-2024-24776 | Low | 3.1 | 2024-02-09 | Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a use… |
CVE-2024-24774 | Low | 3.4 | 2024-02-09 | Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription… |
CVE-2024-23319 | Low | 3.5 | 2024-02-09 | Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connec… |
CVE-2023-50333 | Low | 3.7 | 2024-01-02 | Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group nam… |
CVE-2023-48732 | Medium | 4.3 | 2024-01-02 | Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about… |
CVE-2023-47858 | Medium | 4.3 | 2024-01-02 | Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archiv… |
CVE-2023-7114 | High | 7.1 | 2023-12-29 | Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server. |
CVE-2023-7113 | Low | 3.7 | 2023-12-29 | Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client. |
CVE-2023-6727 | Low | 3.1 | 2023-12-12 | Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook acti… |
CVE-2023-6547 | Low | 3.7 | 2023-12-12 | Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to th… |
CVE-2023-49874 | Medium | 4.3 | 2023-12-12 | Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playboo… |
CVE-2023-49809 | Medium | 4.3 | 2023-12-12 | Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and mak… |
CVE-2023-49607 | Medium | 4.3 | 2023-12-12 | Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialo… |
CVE-2023-46701 | Medium | 6.5 | 2023-12-12 | Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an att… |
CVE-2023-45847 | Medium | 4.3 | 2023-12-12 | Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and cr… |
CVE-2023-45316 | High | 7.3 | 2023-12-12 | Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker… |
CVE-2023-6459 | Medium | 5.3 | 2023-12-06 | Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint i… |
CVE-2023-6458 | High | 7.1 | 2023-12-06 | Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal. |
CVE-2023-6202 | Medium | 4.3 | 2023-11-27 | Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of… |
CVE-2023-48369 | Medium | 4.3 | 2023-11-27 | Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow th… |
CVE-2023-48268 | Medium | 4.3 | 2023-11-27 | Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excess… |
CVE-2023-47168 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providi… |
CVE-2023-45223 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another us… |
CVE-2023-43754 | Medium | 4.3 | 2023-11-27 | Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view… |
CVE-2023-40703 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resource… |
CVE-2023-35075 | Low | 3.1 | 2023-11-27 | Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a vict… |
CVE-2023-47865 | Medium | 4.3 | 2023-11-27 | Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to ove… |
CVE-2023-5969 | Medium | 5.3 | 2023-11-06 | Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_lo… |
CVE-2023-5968 | Medium | 4.9 | 2023-11-06 | Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. |
CVE-2023-5967 | Medium | 4.3 | 2023-11-06 | Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and cra… |
CVE-2023-5920 | Low | 2.9 | 2023-11-02 | Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard inpu… |