CVE-2019-20887: Missing Authorization

An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can receive intra-team posts...

CVE-2019-20870: Improper Input Validation

An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID...

PT-2020-10830

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.11.0 Description An issue allows an attacker to interfere with a channel's post loading via one crafted post. Recommendations For versions prior to 5.11.0, update to version 5.11.0 or later to resolve the...

CVE-2019-20889: Incorrect Default Permissions

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation...

PT-2020-8419

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: The issue allows attackers to cause a denial of service, resulting in channel invisibility, via a misformatted post...

PT-2020-8904

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 4.8.1 Mattermost Server version 4.7.4 Mattermost Server version 4.6.3 Description An issue was discovered where an e-mail invite accidentally included the team invite id, leading to unintended excessive...

PT-2020-8004

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.0 Description: An issue allows attackers to obtain sensitive information about team URLs via an API. Recommendations: For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue...

CVE-2017-18883: Insufficient Entropy

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...

CVE-2017-18895: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information user statuses via a REST API version 4 endpoint...

PT-2020-10840

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.9.0 Mattermost Server version 5.8.1 and earlier Mattermost Server version 5.7.3 and earlier Mattermost Server version 4.10.8 and earlier Description An issue allows attackers to obtain sensitive informatio...

PT-2020-7996

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.2.0 Description: An issue was discovered that allows crafted posts to cause a web browser to hang. Recommendations: For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue...

PT-2020-8900

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue was discovered that allows attackers to bypass intended access restrictions for setting a channel header via the Channel header slash command API. Recommendations For versions prior ...

PT-2020-10829

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.12.0 Description An issue was discovered where the use of a Proxy HTTP header for obtaining IP address information was mishandled, rather than using the source address in an IP packet header. Recommendatio...

PT-2020-14019 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.19.0 Description: An issue was discovered that allows attackers to rename a channel and cause a collision with a direct message. Recommendations: For versions prior to 5.19.0, update to version 5.19.0 or...

PT-2020-14007 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.23.0 Description: An issue allows attackers to cause a denial of service infinite loop by sending large webhook requests. Recommendations: For versions prior to 5.23.0, update to version 5.23.0 or later t...

PT-2020-8009

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.0 Description: An issue was discovered in Mattermost Server. It offers superfluous APIs for a Team Administrator to view account details. Recommendations: For versions prior to 3.0.0, update to version...

CVE-2016-11079: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL...

CVE-2020-14460: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001...

CVE-2020-14453: Insufficient Verification of Data Authenticity

An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005...

CVE-2020-14450: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service client-side, aka MMSA-2020-0017...