CVE-2020-14450

Mattermost Server prior to version 5.22.0 is affected by a client-side denial of service via the markdown renderer (CVE-2020-14450, aka MMSA-2020-0017). The issue is triggered during markdown rendering and impacts availability from a client perspective. The Red Hat, OSV, and other feeds confirm t...

CVE-2020-14450

An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service client-side, aka MMSA-2020-0017...

CVE-2020-14448

An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0020...

CVE-2020-14447

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

PT-2020-7995

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.2.0 Description: An issue was discovered in the Mattermost Server where the initial load API endpoint disclosed unnecessary personal information. Recommendations: For versions prior to 3.2.0, update to...

PT-2020-8454

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered where a password-reset request could be sent to an attacker-provided e-mail address...

PT-2020-14018 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.19.0 Description: An issue allows attackers to discover private channels via the "get channel by name" API endpoint. Recommendations: For versions prior to 5.19.0, update to version 5.19.0 or later to...

PT-2020-8442

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: The issue allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint. Recommendations: For...

PT-2020-14007 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.23.0 Description: An issue allows attackers to cause a denial of service infinite loop by sending large webhook requests. Recommendations: For versions prior to 5.23.0, update to version 5.23.0 or later t...

PT-2020-8452

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered when Single Sign-On OAuth2 is used, allowing an attacker to claim somebody else's account...

PT-2020-8458

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered that allows an attacker to specify a full pathname of a log file...

PT-2020-8420

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server when local storage for files is used, allowing a System Admin to achieve...

PT-2020-14012 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.21.0 Description: An issue was discovered that allows directory traversal via HTTP. This issue affects Mattermost Server and is related to the mmctl component. Recommendations: For versions prior to 5.21....

PT-2020-8463

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered related to weak hashing used for e-mail invitations, OAuth, and e-mail...

PT-2020-8438

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: An issue was discovered in Mattermost Server where e-mail templates can have a field in which HTML content is not...

PT-2020-14013 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.21.0 Description: An issue was discovered that allows attackers to cause a denial of service due to socket read operations not being appropriately restricted. Recommendations: For versions prior to 5.21.0...

PT-2020-7997

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.2.0 Description: An issue was discovered that allows attackers to read LDAP fields via injection. Recommendations: For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue...

PT-2020-14008 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.23.0 Description: An issue allows attackers to cause a denial of service, specifically an infinite loop, by exploiting automatic direct message replies. Recommendations: For versions prior to 5.23.0, upda...

PT-2020-8462

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: The issue concerns API endpoint access control not honoring an integration permission restriction...

PT-2020-14020 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.19.0 Mattermost Server version 5.18.1 Mattermost Server version 5.17.3 Mattermost Server version 5.16.5 Mattermost Server version 5.9.8 Description: An issue was discovered where creation of a trusted OAu...