Mattermost 日志信息泄露漏洞

Mattermost is an open source collaboration platform from US-based Mattermost. A log information disclosure vulnerability exists in Mattermost Sever, which stems from the inability to edit database usernames and passwords before issuing application logs during server initialization...

Mattermost Server < 7.1.6 / 7.2.x < 7.7.2 XSS (MMSA-2023-00139)

The version of Mattermost Server running on the remote host is prior to 7.1.6 or 7.2.x prior to 7.7.2. It is, therefore , affected by a cross-site scripting XSS vulnerability. An authenticated, remote attacker can upload a malicious SVG image file as an attachment to a card and share it using a...

Mattermost Server < 7.1.6 / 7.2.x < 7.7.2 / 7.8.x < 7.8.1 Information Disclosure (MMSA-2023-00141)

The version of Mattermost Server running on the remote host is prior to 7.1.6, 7.2.x prior to 7.7.2 or 7.8.x prior to 7.8.1. It is, therefore, affected by an information disclosure vulnerability. An unauthenticated, remote attacker can request a preview of an existing message when creating a new...

Information Disclosure

github.com/mattermost/mattermost-server is vulnerable to Information Disclosure. The vulnerability exists because the library fails to sanitize the related WebSocket event sent to currently connected clients, which allows an attacker to see the name, display name, description, and other data when...

Cross-Site Scripting (XSS)

github.com/mattermost/mattermost-server is vulnerable to Cross-Site Scripting XSS attacks. An attacker is able to send AJAX requests on behalf of the victim through OAuth flow completion endpoints via sharing a crafted link with a malicious state parameter...

Mattermost Server < 7.4.0 DoS (MMSA-2022-00124)

The version of Mattermost Server running on the remote host is prior to 7.4.0. It is, therefore, affected by a denial of service DoS vulnerability. An authenticated, remote attacker can crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data. No...

Mattermost Server < 7.1.4 / 7.2.x < 7.2.1 / 7.3.x < 7.3.1 DoS (MMSA-2022-00120)

The version of Mattermost Server running on the remote host is prior to 7.1.4, 7.2.x prior to 7.2.1, or 7.3.x prior to 7.3.1. It is, therefore, affected by a denial of service DoS vulnerability. An authenticated, remote attacker can crash the server via multiple large out-of-office or autorespond...

Denial Of Service (DOS)

github.com/mattermost/mattermost-server is vulnerable to Denial Of Service DOS. The vulnerability exists in userstore.go because it will send multiple requests to one of the api endpoints which could fetch a large amount of data by an authenticated user to crash the server...

Vulnerabilities fixed in Mattermost Server

Two vulnerabilities have been fixed in Mattermost Server. The vulnerabilities allow an authenticated remote malicious person able to perform a denial-of-service attack by crashing the server crashing the server. To do this, the malicious party must send multiple prepared requests to the server...

CVE-2022-4045 Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost server

A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data...

CVE-2022-4044 Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages...

Mattermost Server 7.1.0 DoS (MMSA-2022-00115)

The version of Mattermost Server running on the remote host is 7.1.0. It is, therefore, affected by a denial of service DoS vulnerability. An authenticated, remote attacker can upload a specially crafted GIF file when creating a post which causes resource exhaustion on the host. Note that Nessus...

Mattermost Server Detection

Binary data mattermostserverdetect.nbin...

Denial Of Service (DoS)

github.com/mattermost/mattermost-server is vulnerable to denial of service. The vulnerability exists in multiple functions in gif.go due to resource exhaustion in gif file which allows an attacker to cause an application crash via a malicious input...

CVE-2022-1982 A crafted SVG attachment can crash a Mattermost server

Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post...

Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command

An issue was discovered in Mattermost Server before 5.1.0. It allows attackers to cause a denial of service via the invitepeople slash command...

GHSA-5MH6-P63G-3MV5 Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command

An issue was discovered in Mattermost Server before 5.1.0. It allows attackers to cause a denial of service via the invitepeople slash command...

Mattermost Server has Improper Authorization for Integration Requests

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction...

GHSA-HXXJ-8PHW-74VW Mattermost Server server restarts may provide attackers with API access

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access...

GHSA-M462-MQW4-2C8M Mattermost Server has X.509 Improper Certificate Validation

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server...