PT-2020-8438

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: An issue was discovered in Mattermost Server where e-mail templates can have a field in which HTML content is not...

CVE-2017-18892: Improper Encoding or Escaping of Output

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized...

PT-2020-8424

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server where knowledge of a session ID allows revoking another user's session...

PT-2020-10838

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.9.0 Mattermost Server versions prior to 5.8.1 Mattermost Server versions prior to 5.7.3 Mattermost Server versions prior to 4.10.8 Description The issue allows a password reset to proceed while an e-mail...

CVE-2020-14458: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004...

PT-2020-14018 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.19.0 Description: An issue allows attackers to discover private channels via the "get channel by name" API endpoint. Recommendations: For versions prior to 5.19.0, update to version 5.19.0 or later to...

PT-2020-8460

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered where an external link can occur on an error page even if it is not on an...

PT-2020-10818

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.16.1 Mattermost Server versions prior to 5.15.2 Mattermost Server versions prior to 5.14.5 Mattermost Server versions prior to 5.9.6 Description The issue allows attackers to obtain sensitive information,...

PT-2020-10806

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.18.0 Mattermost Server version 5.17.2 Mattermost Server version 5.16.4 Mattermost Server version 5.15.4 Mattermost Server version 5.9.7 Description The issue is related to weak permissions for configuratio...

PT-2020-10855

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.7 Description An issue in Mattermost Server allows a bypass of e-mail address discovery restrictions. Recommendations For versions prior to 5.7, update to version 5.7 or later to resolve the issue...

PT-2020-10841

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.9.0 Mattermost Server versions prior to 5.8.1 Mattermost Server versions prior to 5.7.3 Mattermost Server versions prior to 4.10.8 Description An issue was discovered where changes to e-mail addresses with...

PT-2020-8892

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.3.0 Description The issue is related to the mishandling of timing in the Mattermost Server. Recommendations For versions prior to 5.3.0, update to version 5.3.0 or later to resolve the issue...

PT-2020-7995

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.2.0 Description: An issue was discovered in the Mattermost Server where the initial load API endpoint disclosed unnecessary personal information. Recommendations: For versions prior to 3.2.0, update to...

PT-2020-7997

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.2.0 Description: An issue was discovered that allows attackers to read LDAP fields via injection. Recommendations: For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue...

PT-2020-8462

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: The issue concerns API endpoint access control not honoring an integration permission restriction...

PT-2020-8458

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered that allows an attacker to specify a full pathname of a log file...

PT-2020-8461

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered in Mattermost Server. After a restart of a server, an attacker might suddenly...

PT-2020-8454

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered where a password-reset request could be sent to an attacker-provided e-mail address...

PT-2020-8452

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered when Single Sign-On OAuth2 is used, allowing an attacker to claim somebody else's account...

PT-2020-10817

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.17.0 Description An issue allows remote attackers to cause a denial of service, resulting in a client-side application crash, via a LaTeX message. Recommendations For versions prior to 5.17.0, update to...