Mattermost
Page 5 of 7 — Mattermost CVEs from a corpus of 648, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5876 | Low | 3.1 | 2023-11-02 | Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Servic… |
CVE-2023-5875 | Low | 3.7 | 2023-11-02 | Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious… |
CVE-2023-5522 | Medium | 4.3 | 2023-10-17 | Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and… |
CVE-2023-5339 | Medium | 4.7 | 2023-10-17 | Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password ent… |
CVE-2023-5333 | Medium | 4.3 | 2023-10-09 | Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specia… |
CVE-2023-5331 | Medium | 4.3 | 2023-10-09 | Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information. |
CVE-2023-5330 | Medium | 4.3 | 2023-10-09 | Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4… |
CVE-2023-5160 | Medium | 4.3 | 2023-10-02 | Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another us… |
CVE-2023-5196 | Medium | 6.5 | 2023-09-29 | Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop result… |
CVE-2023-5195 | Medium | 6.5 | 2023-09-29 | Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of |
CVE-2023-5194 | Low | 2.7 | 2023-09-29 | Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manag… |
CVE-2023-5193 | Medium | 4.9 | 2023-09-29 | Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a… |
CVE-2023-5159 | Low | 3.8 | 2023-09-29 | Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots… |
CVE-2023-4478 | Medium | 4.3 | 2023-08-25 | Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking… |
CVE-2023-4108 | Medium | 4.5 | 2023-08-11 | Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged |
CVE-2023-4107 | Medium | 6.7 | 2023-08-11 | Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details… |
CVE-2023-4106 | Medium | 6.3 | 2023-08-11 | Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join… |
CVE-2023-4105 | Low | 3.1 | 2023-08-11 | Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of… |
CVE-2023-3615 | High | 8.1 | 2023-07-17 | Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSock… |
CVE-2023-3614 | Medium | 4.3 | 2023-07-17 | Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsiv… |
CVE-2023-3613 | Low | 3.5 | 2023-07-17 | Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invite… |
CVE-2023-3593 | Medium | 4.3 | 2023-07-17 | Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input. |
CVE-2023-3591 | Medium | 4.8 | 2023-07-17 | Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created. |
CVE-2023-3590 | Low | 3.1 | 2023-07-17 | Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments. |
CVE-2023-3587 | Low | 2.7 | 2023-07-17 | Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join th… |
CVE-2023-3586 | Medium | 4.2 | 2023-07-17 | Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boa… |
CVE-2023-3585 | Medium | 4.3 | 2023-07-17 | Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link. |
CVE-2023-3584 | Low | 3.1 | 2023-07-17 | Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated att… |
CVE-2023-3582 | Medium | 4.3 | 2023-07-17 | Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private chann… |
CVE-2023-3581 | Medium | 6.2 | 2023-07-17 | Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs. |
CVE-2023-3577 | Low | 3.5 | 2023-07-17 | Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SS… |
CVE-2023-2831 | Medium | 4.3 | 2023-06-16 | Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a la… |
CVE-2023-2797 | Low | 3.1 | 2023-06-16 | Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a chan… |
CVE-2023-2793 | Medium | 6.5 | 2023-06-16 | Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by… |
CVE-2023-2792 | Medium | 6.5 | 2023-06-16 | Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command. |
CVE-2023-2785 | Medium | 4.3 | 2023-06-16 | Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files wh… |
CVE-2023-2791 | Medium | 4.3 | 2023-06-16 | When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel… |
CVE-2023-2788 | Medium | 6.2 | 2023-06-16 | Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent acce… |
CVE-2023-2787 | Medium | 6.5 | 2023-06-16 | Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API. |
CVE-2023-2786 | Medium | 4.3 | 2023-06-16 | Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually pos… |
CVE-2023-2784 | Medium | 4.2 | 2023-06-16 | Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests… |
CVE-2023-2783 | Medium | 4.3 | 2023-06-16 | Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent b… |
CVE-2023-2808 | Medium | 4.3 | 2023-05-29 | Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link… |
CVE-2023-2515 | Medium | 4.7 | 2023-05-12 | Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin |
CVE-2023-2514 | Medium | 6.7 | 2023-05-12 | Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. |
CVE-2023-2000 | Medium | 5.4 | 2023-05-02 | Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website |
CVE-2023-2281 | Low | 3.1 | 2023-04-25 | When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, d… |
CVE-2023-2193 | Medium | 6.5 | 2023-04-20 | Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate… |
CVE-2023-1831 | High | 7.2 | 2023-04-17 | Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logg… |
CVE-2023-1777 | Medium | 6.5 | 2023-03-31 | Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of t… |
CVE-2023-1776 | High | 7.3 | 2023-03-31 | Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file. |
CVE-2023-1775 | Medium | 4.3 | 2023-03-31 | When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leadin… |
CVE-2023-1774 | Medium | 4.2 | 2023-03-31 | When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to… |
CVE-2023-1562 | Low | 3.5 | 2023-03-22 | Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to lea… |
CVE-2023-1421 | Low | 3.5 | 2023-03-15 | A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the v… |
CVE-2023-27266 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team… |
CVE-2023-27265 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team… |
CVE-2023-27264 | High | 7.1 | 2023-02-27 | A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbook… |
CVE-2023-27263 | Medium | 4.3 | 2023-02-27 | A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are… |
CVE-2022-4045 | Low | 3.1 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which co… |
CVE-2022-4044 | Medium | 4.3 | 2022-11-23 | A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. |
CVE-2022-4019 | Medium | 4.3 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the… |
CVE-2022-3257 | Low | 3.1 | 2022-09-23 | Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows auth… |
CVE-2022-3147 | Low | 3.1 | 2022-09-09 | Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to… |
CVE-2022-2408 | Medium | 4.3 | 2022-07-14 | The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all… |
CVE-2022-2406 | Medium | 4.3 | 2022-07-14 | The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated atta… |
CVE-2022-2401 | Medium | 6.5 | 2022-07-14 | Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly a… |
CVE-2022-2366 | Medium | 5.6 | 2022-07-12 | Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place o… |
CVE-2022-1982 | Medium | 4.3 | 2022-06-02 | Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on… |
CVE-2022-1548 | Low | 3.7 | 2022-05-03 | Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership priv… |
CVE-2022-1385 | Low | 3.7 | 2022-04-19 | Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accident… |
CVE-2022-1384 | Medium | 4.7 | 2022-04-19 | Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated… |
CVE-2022-1337 | Medium | 4.3 | 2022-04-13 | The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attack… |
CVE-2022-1333 | Low | 3.5 | 2022-04-13 | Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to… |
CVE-2022-1332 | Medium | 4.3 | 2022-04-13 | One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom… |
CVE-2022-1003 | Low | 3.3 | 2022-03-18 | One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two dis… |
CVE-2022-1002 | Low | 2.0 | 2022-03-18 | Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with specia… |
CVE-2022-0904 | Medium | 4.3 | 2022-03-10 | A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting… |
CVE-2022-0903 | Medium | 5.3 | 2022-03-10 | A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submi… |
CVE-2022-0708 | Medium | 4.3 | 2022-02-21 | Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access… |
CVE-2021-37867 | Medium | 4.3 | 2022-01-18 | Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthori… |
CVE-2021-37866 | Medium | 4.7 | 2022-01-18 | Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reu… |
CVE-2021-37865 | Medium | 4.3 | 2022-01-18 | Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated… |
CVE-2021-37864 | Low | 2.6 | 2022-01-18 | Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of arc… |
CVE-2021-37863 | Low | 3.5 | 2021-12-17 | Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of… |
CVE-2021-37862 | Low | 3.7 | 2021-12-17 | Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using at… |
CVE-2021-37861 | Medium | 5.8 | 2021-12-09 | Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails. |
CVE-2021-37860 | Low | 3.7 | 2021-09-22 | Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product… |
CVE-2021-37859 | High | 7.1 | 2021-08-05 | Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost. |
CVE-2020-13891 | High | 7.5 | 2020-06-26 | An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-20… |
CVE-2017-18921 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page. |
CVE-2017-18920 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy. |
CVE-2017-18919 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation. |
CVE-2017-18918 | Medium | 4.9 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname. |
CVE-2017-18917 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification token… |
CVE-2017-18916 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction. |
CVE-2017-18915 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access. |
CVE-2017-18914 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist. |
CVE-2017-18913 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page. |
CVE-2017-18908 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address. |