Mattermost
Page 4 of 7 — Mattermost CVEs from a corpus of 613, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5270 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a… |
CVE-2024-36255 | Medium | 5.7 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run… |
CVE-2024-36241 | Low | 3.1 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents… |
CVE-2024-34152 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a publ… |
CVE-2024-34029 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<group-id>/channels/<… |
CVE-2024-32045 | Medium | 5.9 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playb… |
CVE-2024-31859 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in… |
CVE-2024-29215 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash co… |
CVE-2024-4198 | Low | 2.7 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin… |
CVE-2024-4195 | Low | 2.7 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team ad… |
CVE-2024-4183 | Medium | 4.3 | 2024-04-26 | Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows a… |
CVE-2024-4182 | Medium | 4.3 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which al… |
CVE-2024-32046 | Medium | 4.3 | 2024-04-26 | Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the devel… |
CVE-2024-22091 | Low | 3.1 | 2024-04-26 | Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs whic… |
CVE-2024-3872 | Low | 3.1 | 2024-04-16 | Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allows an unauthenticat… |
CVE-2024-2447 | Medium | 6.5 | 2024-04-05 | Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of pos… |
CVE-2024-29221 | Medium | 4.7 | 2024-04-05 | Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access cont… |
CVE-2024-28949 | Medium | 4.3 | 2024-04-05 | Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which all… |
CVE-2024-21848 | Low | 3.1 | 2024-04-05 | Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in… |
CVE-2024-2450 | High | 8.8 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switchi… |
CVE-2024-2446 | Medium | 4.3 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per me… |
CVE-2024-2445 | Medium | 6.1 | 2024-03-15 | Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to es… |
CVE-2024-28053 | Low | 3.1 | 2024-03-15 | Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker t… |
CVE-2024-24975 | Low | 3.5 | 2024-03-15 | Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails to limit the size of the code block that will be processed by the syntax hi… |
CVE-2024-1953 | Medium | 4.3 | 2024-02-29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowi… |
CVE-2024-1952 | Low | 3.1 | 2024-02-29 | Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated atta… |
CVE-2024-1949 | Low | 2.6 | 2024-02-29 | A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual p… |
CVE-2024-1942 | Medium | 4.3 | 2024-02-29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, w… |
CVE-2024-1888 | Medium | 4.3 | 2024-02-29 | Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members… |
CVE-2024-24988 | Medium | 4.3 | 2024-02-29 | Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string a… |
CVE-2024-23493 | Medium | 4.3 | 2024-02-29 | Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that… |
CVE-2024-23488 | Low | 3.1 | 2024-02-29 | Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived… |
CVE-2024-1887 | Medium | 4.3 | 2024-02-29 | Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to… |
CVE-2024-1402 | Medium | 4.3 | 2024-02-09 | Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, a… |
CVE-2024-24776 | Low | 3.1 | 2024-02-09 | Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a use… |
CVE-2024-24774 | Low | 3.4 | 2024-02-09 | Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription… |
CVE-2024-23319 | Low | 3.5 | 2024-02-09 | Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connec… |
CVE-2023-50333 | Low | 3.7 | 2024-01-02 | Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group nam… |
CVE-2023-48732 | Medium | 4.3 | 2024-01-02 | Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about… |
CVE-2023-47858 | Medium | 4.3 | 2024-01-02 | Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archiv… |
CVE-2023-7114 | High | 7.1 | 2023-12-29 | Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server. |
CVE-2023-7113 | Low | 3.7 | 2023-12-29 | Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client. |
CVE-2023-6727 | Low | 3.1 | 2023-12-12 | Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook acti… |
CVE-2023-6547 | Low | 3.7 | 2023-12-12 | Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to th… |
CVE-2023-49874 | Medium | 4.3 | 2023-12-12 | Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playboo… |
CVE-2023-49809 | Medium | 4.3 | 2023-12-12 | Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and mak… |
CVE-2023-49607 | Medium | 4.3 | 2023-12-12 | Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialo… |
CVE-2023-46701 | Medium | 6.5 | 2023-12-12 | Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an att… |
CVE-2023-45847 | Medium | 4.3 | 2023-12-12 | Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and cr… |
CVE-2023-45316 | High | 7.3 | 2023-12-12 | Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker… |
CVE-2023-6459 | Medium | 5.3 | 2023-12-06 | Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint i… |
CVE-2023-6458 | High | 7.1 | 2023-12-06 | Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal. |
CVE-2023-6202 | Medium | 4.3 | 2023-11-27 | Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of… |
CVE-2023-48369 | Medium | 4.3 | 2023-11-27 | Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow th… |
CVE-2023-48268 | Medium | 4.3 | 2023-11-27 | Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excess… |
CVE-2023-47168 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providi… |
CVE-2023-45223 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another us… |
CVE-2023-43754 | Medium | 4.3 | 2023-11-27 | Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view… |
CVE-2023-40703 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resource… |
CVE-2023-35075 | Low | 3.1 | 2023-11-27 | Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a vict… |
CVE-2023-47865 | Medium | 4.3 | 2023-11-27 | Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to ove… |
CVE-2023-5969 | Medium | 5.3 | 2023-11-06 | Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_lo… |
CVE-2023-5968 | Medium | 4.9 | 2023-11-06 | Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. |
CVE-2023-5967 | Medium | 4.3 | 2023-11-06 | Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and cra… |
CVE-2023-5920 | Low | 2.9 | 2023-11-02 | Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard inpu… |
CVE-2023-5876 | Low | 3.1 | 2023-11-02 | Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Servic… |
CVE-2023-5875 | Low | 3.7 | 2023-11-02 | Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious… |
CVE-2023-5522 | Medium | 4.3 | 2023-10-17 | Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and… |
CVE-2023-5339 | Medium | 4.7 | 2023-10-17 | Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password ent… |
CVE-2023-5333 | Medium | 4.3 | 2023-10-09 | Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specia… |
CVE-2023-5331 | Medium | 4.3 | 2023-10-09 | Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information. |
CVE-2023-5330 | Medium | 4.3 | 2023-10-09 | Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4… |
CVE-2023-5160 | Medium | 4.3 | 2023-10-02 | Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another us… |
CVE-2023-5196 | Medium | 6.5 | 2023-09-29 | Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop result… |
CVE-2023-5195 | Medium | 6.5 | 2023-09-29 | Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of |
CVE-2023-5194 | Low | 2.7 | 2023-09-29 | Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manag… |
CVE-2023-5193 | Medium | 4.9 | 2023-09-29 | Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a… |
CVE-2023-5159 | Low | 3.8 | 2023-09-29 | Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots… |
CVE-2023-4478 | Medium | 4.3 | 2023-08-25 | Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking… |
CVE-2023-4108 | Medium | 4.5 | 2023-08-11 | Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged |
CVE-2023-4107 | Medium | 6.7 | 2023-08-11 | Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details… |
CVE-2023-4106 | Medium | 6.3 | 2023-08-11 | Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join… |
CVE-2023-4105 | Low | 3.1 | 2023-08-11 | Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of… |
CVE-2023-3615 | High | 8.1 | 2023-07-17 | Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSock… |
CVE-2023-3614 | Medium | 4.3 | 2023-07-17 | Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsiv… |
CVE-2023-3613 | Low | 3.5 | 2023-07-17 | Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invite… |
CVE-2023-3593 | Medium | 4.3 | 2023-07-17 | Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input. |
CVE-2023-3591 | Medium | 4.8 | 2023-07-17 | Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created. |
CVE-2023-3590 | Low | 3.1 | 2023-07-17 | Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments. |
CVE-2023-3587 | Low | 2.7 | 2023-07-17 | Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join th… |
CVE-2023-3586 | Medium | 4.2 | 2023-07-17 | Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boa… |
CVE-2023-3585 | Medium | 4.3 | 2023-07-17 | Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link. |
CVE-2023-3584 | Low | 3.1 | 2023-07-17 | Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated att… |
CVE-2023-3582 | Medium | 4.3 | 2023-07-17 | Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private chann… |
CVE-2023-3581 | Medium | 6.2 | 2023-07-17 | Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs. |
CVE-2023-3577 | Low | 3.5 | 2023-07-17 | Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SS… |
CVE-2023-2831 | Medium | 4.3 | 2023-06-16 | Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a la… |
CVE-2023-2797 | Low | 3.1 | 2023-06-16 | Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a chan… |
CVE-2023-2793 | Medium | 6.5 | 2023-06-16 | Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by… |
CVE-2023-2792 | Medium | 6.5 | 2023-06-16 | Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command. |