CVE-2019-20841

Mattermost Server is affected by CVE-2019-20841 a CSRF issue that can enable account takeover via a crafted web site. The vulnerability is described across multiple sources as affecting Mattermost Server before versions 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. Connected documents corroborate th...

CVE-2019-20841

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks...

CVE-2020-14460

An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001...

CVE-2020-14460

Mattermost Server vulnerability CVE-2020-14460 affects versions prior to 5.19.0, including 5.18.1, 5.17.3, 5.16.5 and 5.9.8, where creating a trusted OAuth application may bypass admin privileges. Root cause details are not explicitly stated in the provided documents, but remediation is to upgrad...

CVE-2020-14459

CVE-2020-14459 affects Mattermost Server prior to 5.19.0. The vulnerability allows attackers to rename a channel and cause a collision with a direct message, described across multiple sources (e.g., PT‑2020‑14019). Impact is the potential confusion or misrouting between channel and direct message...

CVE-2020-14459

An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002...

CVE-2020-14458

Mattermost Server before 5.19.0 is affected. The issue allows attackers to discover private channels through the get channel by name API (MMSA-2020-0004), an information-disclosure vulnerability. Affected product is Mattermost Server; vulnerable component is the get channel by name API endpoint. ...

CVE-2020-14458

An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004...

CVE-2020-14457

An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the updateteam WebSocket event, aka MMSA-2020-0012...

CVE-2020-14457

Technical details about CVE-2020-14457 are not provided in the connected documents; only the basic description and references are available. Monitor for updates.

CVE-2020-14456

Mattermost Desktop App

CVE-2020-14456

An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-2020-0006...

CVE-2020-14455

An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007...

CVE-2020-14455

Technical details beyond the provided description are not publicly available in the supplied documents. Monitor for updates.

CVE-2020-14454

An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka MMSA-2020-0008...

CVE-2020-14454

Mattermost Desktop App vulnerability CVE-2020-14454 affects versions prior to 4.4.0. Root cause: improper handling of server redirects, enabling an attacker to open web pages within the desktop app via mishandled redirection (MMSA-2020-0008). Impact details in sources indicate the issue could rel...

CVE-2020-14453

Mattermost CVE-2020-14453 affects Mattermost Server prior to 5.21.0. Root cause: socket read operations are not appropriately restricted, enabling denial of service. Impact: partial or total DoS as described in sources. Remediation: upgrade to Mattermost Server 5.21.0 or later; as a temporary mea...

CVE-2020-14453

An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005...

CVE-2020-14452

An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014...

CVE-2020-14452

CVE-2020-14452 affects Mattermost Server prior to 5.21.0. The issue, stemming from the mmctl component, allows directory traversal through HTTP requests, enabling access to restricted file paths. Impact is described as a path traversal vulnerability in the Mattermost Server/MMctl workflow. Affect...