Server side request forgery (ssrf)

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services...

Cross site request forgery (csrf)

An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF...

Code injection

An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation...

Code injection

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking...

CVE-2019-20874

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change...

CVE-2019-20874

Mattermost Server contains an information disclosure issue affecting versions prior to 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The vulnerability allows an attacker to obtain sensitive information during a role change. Connected sources (e.g., Red Hat CVE page and NVD entry) confirm the affected versions...

CVE-2019-20873

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation...

CVE-2019-20873

Technical details about CVE-2019-20873 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

CVE-2019-20872

Mattermost Server contains an SSRF vulnerability in versions before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 that could target local services. The available connected documents confirm the issue and affected versions but do not provide additional exploit details, patch versions, or remediation steps. Moni...

CVE-2019-20872

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services...

CVE-2019-20871

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking...

CVE-2019-20871

Mattermost Server contains a vulnerability (CVE-2019-20871) in the Markdown rendering path affecting Mattermost Server releases prior to 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The issue is due to the Markdown library allowing catastrophic backtracking. The provided connected documents do not specify a ...

CVE-2019-20870

Mattermost Server before 5.10.0 contains a vulnerability where an attacker can bypass the intended appearance of the Edited flag after changing a post’s file ID. Affected product: Mattermost Server (versions prior to 5.10.0). Root cause: manipulation of the post’s file ID leads to misrepresentati...

CVE-2019-20870

An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID...

CVE-2019-20869

An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel...

CVE-2019-20869

Technical details for CVE-2019-20869 are not publicly available in the provided documents. Monitor for updates.

CVE-2019-20868

CVE-2019-20868 affects Mattermost Server versions before 5.11.0 where invite IDs were improperly generated. The connected sources consistently describe the issue as an input/invite ID generation flaw in Mattermost Server prior to 5.11.0; no exploitation details, exploit vectors, or impact are exp...

CVE-2019-20868

An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated...

CVE-2019-20867

Mattermost Server (before 5.11.0) is affected by CVE-2019-20867 where a crafted post can interfere with a channel’s post loading. Root cause relates to input handling in posts; multiple connected sources (Red Hat CVE page, CNVD-2020-35437, OSV) corroborate the issue. Supported remediation: upgrad...