Arbitrary file deletion

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials...

CVE-2018-21257

An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions for setting a channel header via the Channel header slash command API...

CVE-2018-21257

CVE-2018-21257 (Mattermost Server) affects Mattermost Server before 5.1. The issue allows attackers to bypass intended access restrictions for setting a channel header via the Channel header slash command API. Connected sources confirm this vulnerability across multiple trackers (Red Hat, NVD, OS...

CVE-2018-21261

An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team inviteid, which leads to unintended excessive invitation privileges...

CVE-2018-21261

CVE-2018-21261 (Mattermost Server) affects versions prior to 4.8.1, 4.7.4, and 4.6.3. An email invite could include the team invite_id, leading to unintended excessive invitation privileges. Root cause: leakage of invite_id via invites; impact: users may gain expanded invitation privileges. No ex...

CVE-2018-21262

Mattermost Server prior to version 4.7.3 is affected by CVE-2018-21262. The vulnerability arises from handling of LaTeX text, enabling an attacker to cause an application crash (denial of service). The issue is limited to the LaTeX text processing path and has been documented with a CVSS indicati...

CVE-2018-21262

An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service application crash via invalid LaTeX text...

CVE-2018-21265

An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler e.g., video, audio, and notifications...

CVE-2018-21265

Mattermost Desktop App before 4.0.0 is affected by a vulnerability caused by mishandling the Same Origin Policy for setPermissionRequestHandler (affecting video, audio, and notifications). The issue is described across multiple sources (CVE-2018-21265) and is corroborated in Red Hat and CNVD entr...

CVE-2017-18871

Mattermost Server has a DoS vulnerability caused by an @ character prefix before a JavaScript field name, affecting versions prior to 4.5.0, 4.4.5, 4.3.4 and 4.2.2. Exploitation leads to an application crash. Remediation per connected advisories is to upgrade to fixed releases (e.g., 4.5.0+ and c...

CVE-2017-18871

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service application crash via an @ character before a JavaScript field name...

CVE-2018-21250

Mattermost Server is affected before versions 5.2.2, 5.1.2, and 4.10.4. A remote attacker can cause a denial of service by supplying crafted image dimensions, leading to memory consumption. The issue is documented across multiple sources (CVE-2018-21250). No remediation details are provided in th...

CVE-2018-21250

An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service memory consumption via crafted image dimensions...

CVE-2017-18877

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page...

CVE-2017-18877

Mattermost Server contains an XSS vulnerability in the OAuth 2.0 allow/deny page for affected releases (Mattermost Server before 4.3.0, 4.2.1, and 4.1.2). Root cause details are not provided in the documents beyond the page-level description. Exploitation status is not specified; no in-the-wild e...

CVE-2017-18876

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file...

CVE-2017-18876

CVE-2017-18876 affects Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 where local file storage enables a path traversal-like check to determine existence of arbitrary files. Impact is information disclosure via local storage under file storage usage; exploitation requires access via the affecte...

CVE-2018-21255

An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...

CVE-2018-21255

The CVE-2018-21255 issue affects Mattermost Server prior to 5.1, where non-members of a channel could use the Channel PATCH API to modify that channel. The connected documents corroborate this vulnerability across multiple sources (Red Hat, CNVD, OSV, NVD, CVE lists) without providing concrete ex...