CVE-2021-37864: Improper Access Control

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs...

PT-2022-10681 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 6.1 and earlier Description: The issue arises from insufficient permission validation when viewing archived channels. This allows authenticated users to bypass system administrator restrictions and view the contents of...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. An access control error vulnerability exists in Mattermost versions 6.1 and earlier, which stems from a network system or product that does not properly restrict access to resources from unauthorized roles, and could be...

PT-2022-10684

Name of the Vulnerable Software and Affected Versions Mattermost Boards plugin versions prior to 0.10.0 Description The issue allows authenticated and unauthorized users to access sensitive information, specifically email addresses of all users, via one of the Boards APIs. This results in the...

CVE-2021-37867: Exposure of Sensitive Information to an Unauthorized Actor

Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure...

Mattermost 资源管理错误漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A denial of service vulnerability exists in Mattermost versions 6.2.0 and earlier, which arises from a failure to adequately process specially crafted GIF files when uploading them during the drafting ...

CVE-2021-37865: Uncontrolled Resource Consumption

Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service...

PT-2022-10682

Name of the Vulnerable Software and Affected Versions Mattermost versions 6.2 and earlier Description The issue arises from insufficient processing of a specifically crafted GIF file when uploaded while drafting a post. This allows authenticated users to cause resource exhaustion, resulting in a...

Mattermost 信息泄露漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. The Mattermost Boards plugin in v0.10.0 and earlier is vulnerable to an information disclosure vulnerability that stems from a failure to protect all users' email addresses via one of the Board APIs, which could be exploite...

Mattermost 代码问题漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. The Mattermost Boards plugin in v0.10.0 and prior versions is vulnerable to a trust management issue that stems from the lack of an effective trust management mechanism in the network system or product. An attacker could...

PT-2022-10683

Name of the Vulnerable Software and Affected Versions Mattermost Boards plugin versions 0.10.0 and earlier Description The issue allows an attacker to reuse an old session token for authorization because the session is not properly invalidated on the server-side when a user logs out of Boards...

CVE-2021-37866: Insufficient Session Expiration

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization...

Mattermost Code Issue Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A code issue vulnerability exists in Mattermost Focalboard, which stems from the fact that when a user initiates a logout in Mattermost Focalboard, their session does not expire correctly, which can be...

PT-2022-15258

Name of the Vulnerable Software and Affected Versions Mattermost Focalboard versions prior to v0.7.5 Mattermost Focalboard versions prior to v0.8.4 Mattermost Focalboard versions prior to v0.9.5 Mattermost Focalboard versions prior to v0.10.1 Mattermost Focalboard versions prior to v0.11.0-rc1...

Mattermost: html injection via invite members can be leads account takeover

An HTML injection vulnerability was found on the website that allowed an attacker to inject HTML code into an email invitation sent to a victim. This could lead to the victim being redirected to a malicious site or tricked into giving away login credentials...

Mattermost: Bypass Email Verification in Customer Portal

Hi team hope you doing well : i found a vulnerability OTP Bypass on https://portal.test.cloud.mattermost.com . Summery : I was able to use the otp that was sent to victim email and i used it in the attacker's email verify .when i tried this issue first time the server log me out , and second time...

Malicious Package

Overview mattermost-mobile-e2e is a malicious package. This package contained malicious code and was removed from the registry by the npm security team. Remediation Avoid using all malicious instances of the mattermost-mobile-e2e package...

Malicious Package

Overview mattermost-webapp is a malicious package. This package contained malicious code and was removed from the registry by the npm security team. Remediation Avoid using all malicious instances of the mattermost-webapp package...

Malicious Package

Overview mattermost-mobile is a malicious package. This package contained malicious code and was removed from the registry by the npm security team. Remediation Avoid using all malicious instances of the mattermost-mobile package...

Mattermost Input Validation Error Vulnerability (CNVD-2022-08350)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost 6.0 and earlier versions, which can be exploited by an authenticated attacker to cause a WEB application client to crash via a maliciously crafted post...