Mattermost
Page 5 of 7 — Mattermost CVEs from a corpus of 613, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2785 | Medium | 4.3 | 2023-06-16 | Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files wh… |
CVE-2023-2791 | Medium | 4.3 | 2023-06-16 | When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel… |
CVE-2023-2788 | Medium | 6.2 | 2023-06-16 | Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent acce… |
CVE-2023-2787 | Medium | 6.5 | 2023-06-16 | Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API. |
CVE-2023-2786 | Medium | 4.3 | 2023-06-16 | Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually pos… |
CVE-2023-2784 | Medium | 4.2 | 2023-06-16 | Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests… |
CVE-2023-2783 | Medium | 4.3 | 2023-06-16 | Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent b… |
CVE-2023-2808 | Medium | 4.3 | 2023-05-29 | Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link… |
CVE-2023-2515 | Medium | 4.7 | 2023-05-12 | Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin |
CVE-2023-2514 | Medium | 6.7 | 2023-05-12 | Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. |
CVE-2023-2000 | Medium | 5.4 | 2023-05-02 | Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website |
CVE-2023-2281 | Low | 3.1 | 2023-04-25 | When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, d… |
CVE-2023-2193 | Medium | 6.5 | 2023-04-20 | Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate… |
CVE-2023-1831 | High | 7.2 | 2023-04-17 | Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logg… |
CVE-2023-1777 | Medium | 6.5 | 2023-03-31 | Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of t… |
CVE-2023-1776 | High | 7.3 | 2023-03-31 | Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file. |
CVE-2023-1775 | Medium | 4.3 | 2023-03-31 | When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leadin… |
CVE-2023-1774 | Medium | 4.2 | 2023-03-31 | When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to… |
CVE-2023-1562 | Low | 3.5 | 2023-03-22 | Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to lea… |
CVE-2023-1421 | Low | 3.5 | 2023-03-15 | A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the v… |
CVE-2023-27266 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team… |
CVE-2023-27265 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team… |
CVE-2023-27264 | High | 7.1 | 2023-02-27 | A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbook… |
CVE-2023-27263 | Medium | 4.3 | 2023-02-27 | A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are… |
CVE-2022-4045 | Low | 3.1 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which co… |
CVE-2022-4044 | Medium | 4.3 | 2022-11-23 | A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. |
CVE-2022-4019 | Medium | 4.3 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the… |
CVE-2022-3257 | Low | 3.1 | 2022-09-23 | Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows auth… |
CVE-2022-3147 | Low | 3.1 | 2022-09-09 | Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to… |
CVE-2022-2408 | Medium | 4.3 | 2022-07-14 | The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all… |
CVE-2022-2406 | Medium | 4.3 | 2022-07-14 | The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated atta… |
CVE-2022-2401 | Medium | 6.5 | 2022-07-14 | Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly a… |
CVE-2022-2366 | Medium | 5.6 | 2022-07-12 | Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place o… |
CVE-2022-1982 | Medium | 4.3 | 2022-06-02 | Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on… |
CVE-2022-1548 | Low | 3.7 | 2022-05-03 | Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership priv… |
CVE-2022-1385 | Low | 3.7 | 2022-04-19 | Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accident… |
CVE-2022-1384 | Medium | 4.7 | 2022-04-19 | Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated… |
CVE-2022-1337 | Medium | 4.3 | 2022-04-13 | The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attack… |
CVE-2022-1333 | Low | 3.5 | 2022-04-13 | Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to… |
CVE-2022-1332 | Medium | 4.3 | 2022-04-13 | One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom… |
CVE-2022-1003 | Low | 3.3 | 2022-03-18 | One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two dis… |
CVE-2022-1002 | Low | 2.0 | 2022-03-18 | Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with specia… |
CVE-2022-0904 | Medium | 4.3 | 2022-03-10 | A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting… |
CVE-2022-0903 | Medium | 5.3 | 2022-03-10 | A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submi… |
CVE-2022-0708 | Medium | 4.3 | 2022-02-21 | Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access… |
CVE-2021-37867 | Medium | 4.3 | 2022-01-18 | Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthori… |
CVE-2021-37866 | Medium | 4.7 | 2022-01-18 | Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reu… |
CVE-2021-37865 | Medium | 4.3 | 2022-01-18 | Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated… |
CVE-2021-37864 | Low | 2.6 | 2022-01-18 | Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of arc… |
CVE-2021-37863 | Low | 3.5 | 2021-12-17 | Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of… |
CVE-2021-37862 | Low | 3.7 | 2021-12-17 | Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using at… |
CVE-2021-37861 | Medium | 5.8 | 2021-12-09 | Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails. |
CVE-2021-37860 | Low | 3.7 | 2021-09-22 | Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product… |
CVE-2021-37859 | High | 7.1 | 2021-08-05 | Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost. |
CVE-2020-13891 | High | 7.5 | 2020-06-26 | An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-20… |
CVE-2017-18921 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page. |
CVE-2017-18920 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy. |
CVE-2017-18919 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation. |
CVE-2017-18918 | Medium | 4.9 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname. |
CVE-2017-18917 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification token… |
CVE-2017-18916 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction. |
CVE-2017-18915 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access. |
CVE-2017-18914 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist. |
CVE-2017-18913 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page. |
CVE-2017-18908 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address. |
CVE-2017-18907 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header. |
CVE-2017-18906 | High | 8.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's accou… |
CVE-2017-18905 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled. |
CVE-2016-11084 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. |
CVE-2016-11083 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. |
CVE-2016-11082 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. |
CVE-2016-11081 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser. |
CVE-2016-11080 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details. |
CVE-2016-11079 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL. |
CVE-2016-11078 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.jso… |
CVE-2016-11077 | Low | 2.7 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of… |
CVE-2016-11076 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL. |
CVE-2016-11075 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API. |
CVE-2016-11074 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused. |
CVE-2016-11073 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting. |
CVE-2016-11072 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled. |
CVE-2016-11071 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place. |
CVE-2016-11070 | Medium | 5.4 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values. |
CVE-2016-11069 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change. |
CVE-2016-11068 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection. |
CVE-2016-11067 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang. |
CVE-2016-11066 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information. |
CVE-2016-11065 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appe… |
CVE-2016-11064 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection. |
CVE-2016-11063 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview. |
CVE-2016-11062 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed. |
CVE-2015-9548 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file th… |
CVE-2017-18912 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file. |
CVE-2017-18911 | Critical | 9.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server. |
CVE-2017-18910 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links. |
CVE-2017-18909 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory. |
CVE-2017-18904 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file. |
CVE-2017-18903 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled. |
CVE-2017-18902 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints. |
CVE-2017-18901 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document. |