CVE-2018-21258: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invitepeople slash command...

CVE-2019-20875: Improper Authentication

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed...

CVE-2019-20877: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled...

CVE-2017-18911: Improper Certificate Validation

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server...

CVE-2017-18889: Improper Input Validation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...

CVE-2019-20842: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There is SQL injection by admins via SearchAllChannels...

CVE-2017-18894: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover...

CVE-2018-21251: Missing Authorization

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body...

CVE-2015-9548: Uncontrolled Resource Consumption

An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service memory consumption via a small compressed file that has a large size when uncompressed...

PT-2020-7919

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 1.2.0 Description: The issue allows attackers to cause a denial of service due to memory consumption. This can be achieved by using a small compressed file that has a large size when uncompressed...

PT-2020-8463

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered related to weak hashing used for e-mail invitations, OAuth, and e-mail...

CVE-2019-20869: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel...

PT-2020-10832

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.10.0 Mattermost Server versions prior to 5.9.1 Mattermost Server versions prior to 5.8.2 Mattermost Server versions prior to 4.10.9 Description A non-member could change the "Update/Patch Channel" endpoint...

CVE-2017-18907: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header...

PT-2020-10808

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.18.0 Description The issue allows attackers to cause a denial of service, specifically memory consumption, by utilizing a large Slack import. Recommendations For versions prior to 5.18.0, update to version...

CVE-2017-18920: Undefined Security Weakness

An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy...

PT-2020-8444

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: An issue in Mattermost Server allows crafted posts to potentially cause a web browser to hang. Recommendations: For version...

CVE-2019-20866: Inconsistent Interpretation of HTTP Requests

An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled...

PT-2020-8899

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue in Mattermost Server allows attackers to bypass intended access restrictions for group-message channel creation via the Group message slash command. Recommendations For versions prio...

PT-2020-8008

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.0 Description: An issue in Mattermost Server allows XSS via a redirect URL. Recommendations: For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue...